CVE-2020-10783: Undefined Security Weakness

Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files...

CloudForms: Missing functional level access control & IDOR lead to compromise

A flaw was found in Red Hat CloudForms where sensitive data would have been possibly leaked for other existing roles. An attacker with low privilege could make use of EVM-Admin API if certain criteria is met since there was no privilege check on feature...

CloudForms: Missing access control leads to escalation of admin group privileges

A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator. Refer CVE-2020-25716 for remaining RBAC group fixes...

CVE-2020-10783

A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator. Refer CVE-2020-25716 for remaining RBAC group fixes. Mitigation Red...

CVE-2020-10779

A flaw was found in Red Hat CloudForms where sensitive data would have been possibly leaked for other existing roles. An attacker with low privilege could make use of EVM-Admin API if certain criteria is met since there was no privilege check on feature. Mitigation Red Hat has investigated whethe...

PT-2020-3567

Name of the Vulnerable Software and Affected Versions Red Hat CloudForms versions 4.7 through 5 Description The issue is related to insufficient access control in the CloudForms Management Engine, which is a platform for managing virtual environments. This flaw can be exploited by a remote attack...

Py-EVM Security Vulnerability

Py-EVM is a Python-based implementation of an Ethernet virtual machine. A security vulnerability exists in Py-EVM version 0.2.0-alpha.33. An attacker can exploit the vulnerability to cause a denial of service...

ima-evm-utils bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

CVE-2013-0186

Multiple cross-site scripting XSS vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0186

Multiple cross-site scripting XSS vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0186

CVE-2013-0186 covers multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM. The affected component is ManageIQ EVM; the underlying root cause is not explicitly described in the provided documents, but the NVD entry notes remote code injection via unspecified vectors with user intera...

CVE-2013-0186

Multiple cross-site scripting XSS vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0186: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2019-6832 · Red Hat · Manageiq Evm

Name of the Vulnerable Software and Affected Versions: ManageIQ EVM affected versions not specified Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

eth-cobra (>=0.1.0, <=0.1.1), eth-pm (0.1.0a23) +12 more potentially affected by CVE-2018-18920 via py-evm (>=0.2.0a16, <=0.2.0a33)

py-evm PYPI version =0.2.0a16, =0.1.0, =0.1.0b1, =0.1.0a18, =0.2.0rc1, =1.0.0a1, =0.1.2a2, =0.8.0, =0.0.1a3, =0.2.0, =0.1.0a12, =0.1.2b2, =0.1.2b4 Source cves: CVE-2018-18920 Source advisory: GHSA-VQGP-4JGJ-5J64...

Py-EVM is vulnerable to arbitrary bytecode injection

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": 100, 100, 0' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed...

eth-cobra (>=0.1.0, <=0.1.1), eth-pm (0.1.0a23) +12 more potentially affected by CVE-2018-18920 via py-evm (>=0.2.0a16, <=0.2.0a33)

py-evm PYPI version =0.2.0a16, =0.1.0, =0.1.0b1, =0.1.0a18, =0.2.0rc1, =1.0.0a1, =0.1.2a2, =0.8.0, =0.0.1a3, =0.2.0, =0.1.0a12, =0.1.2b2, =0.1.2b4 Source cves: CVE-2018-18920 Source advisory: OSV:GHSA-VQGP-4JGJ-5J64...

Denial Of Service (DoS)

py-evm is vulnerable to a denial of service DoS attack. A malicious user can pass a contract to the application to cause invalid values in the stack, crashing the application...

CVE-2018-18920

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": 100, 100, 0' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed...