C3
Product
Cloudforms 3.0 Management Engine
13
CVEs
0
On KEV
6.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 1Low 0
Watch
Add Cloudforms 3.0 Management Engine to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-7813 | 6.5 | Oct 18 | Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym… Affected: All versions, or not specified |
| CVE-2014-0136 | – | Oct 27 | The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via… Affected: through 5.2.5.3 |
| CVE-2014-3642 | – | Oct 6 | vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via… Affected: 5.2 |
| CVE-2014-0140 | – | Oct 6 | Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request Affected: 5.2 |
| CVE-2014-3489 | – | Jul 7 | lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords… Affected: through 5.2.4; 5.2; 5.2.1; 5.2.1.6; 5.2.2; 5.2.3; +1 more |
| CVE-2014-3486 | – | Jul 7 | The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before… Affected: through 5.2.4; 5.2; 5.2.1; 5.2.1.6; 5.2.2; 5.2.3; +1 more |
| CVE-2014-0184 | – | Jul 7 | Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the… Affected: through 5.2.4; 5.2; 5.2.1; 5.2.1.6; 5.2.2; 5.2.3; +1 more |
| CVE-2014-0180 | – | Jul 7 | The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial… Affected: through 5.2.4; 5.2; 5.2.1; 5.2.1.6; 5.2.2; 5.2.3; +1 more |
| CVE-2014-0176 | – | Jul 7 | Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web… Affected: through 5.2.4; 5.2; 5.2.1; 5.2.1.6; 5.2.2; 5.2.3; +1 more |
| CVE-2014-0137 | – | May 14 | SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated… Affected: through 5.2.3; 5.2; 5.2.1; 5.2.2 |
| CVE-2014-0078 | – | May 14 | The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing… Affected: through 5.2.3; 5.2; 5.2.1; 5.2.2 |
| CVE-2014-0057 | – | Mar 18 | The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute… Affected: 5.2 |
| CVE-2013-6443 | – | Jan 23 | CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF)… Affected: through 5.2.1; 5.2 |
Showing 13