CVE-2019-11358

CVE-2019-11358 is a prototype pollution vulnerability in jQuery (before 3.4.0) where mishandling of extend(true, {}, ...) can extend Object.prototype if an unsanitized source object has an enumerable proto property. The Core issue is triggered when a polluted prototype is introduced via nested ob...

CVE-2019-5418

CVE-2019-5418 (Rails/Action View) affects Rails/Action View versions prior to 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 and v3. The flaw is a File Content Disclosure via specially crafted accept headers in combination with calls to render file:, allowing an attacker to disclose contents of arbitrary fi...

CVE-2019-5419

CVE-2019-5419 describes a denial-of-service in Ruby on Rails Action View triggered by specially crafted Accept headers, affecting Rails <5.2.2.1, <5.1.6.2, <5.0.7.2,

CVE-2013-0186

CVE-2013-0186 covers multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM. The affected component is ManageIQ EVM; the underlying root cause is not explicitly described in the provided documents, but the NVD entry notes remote code injection via unspecified vectors with user intera...

CVE-2019-16892

CVE-2019-16892 in Rubyzip: A crafted ZIP can bypass ZIP-entry size checks because the uncompressed size data can be spoofed, enabling a denial of service via disk consumption. Affected: rubyzip before 1.3.0. Root cause: manipulated size metadata in ZIP entries. Impact: local DoS through excessive...

CVE-2019-10159

CVE-2019-10159 affects cfme-gemset versions 5.10.4.3 and below and 5.9.9.3 and below, due to an improper authorization in the migration log controller that can leak VM migration logs to any unprivileged user. Documents consistently identify the issue as a data-leak vulnerability in cfme-gemset. A...

CVE-2014-0197

CVE-2014-0197 is a Cross-Site Request Forgery (CSRF) vulnerability in CFME/Red Hat CloudForms Management Engine caused by a permissive check of the referrer header. Affected component is CFME web application; impact is partial confidentiality, integrity, and availability compromises per CVSS 3.1/...

CVE-2013-4423

CloudForms (Red Hat CloudForms) is affected by CVE-2013-4423, where user passwords are stored in a recoverable format, enabling potential disclosure of cleartext passwords. The vulnerability concerns the storage mechanism rather than a specific exploit, and public details describe an information ...