CM
Product
Cloudforms Management Engine
42
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 2High 13Medium 21Low 3
Watch
Add Cloudforms Management Engine to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-0197 | 8.8 | Dec 13 | CFME: CSRF protection vulnerability via permissive check of the referrer header Affected: 5.0 through 5.9.3.1 |
| CVE-2016-5402 | 8.8 | Oct 31 | A code injection flaw was found in the way capacity and utilization imported control files are processed Affected: 5.6 |
| CVE-2016-7071 | 8.8 | Sep 10 | It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users Affected: before 5.6.2.2; 5.7.0.0 before 5.7.0.7 |
| CVE-2017-7530 | 8.8 | Jul 26 | In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that… Affected: before 5.7.3; 5.8.0 before 5.8.1 |
| CVE-2014-0087 | 8.8 | Jan 11 | The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated… Affected: before 5.3 |
| CVE-2016-7040 | 8.8 | Oct 7 | Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote… Affected: 4.1 |
| CVE-2018-10905 | 7.8 | Jul 24 | CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms Affected: 5.8; 5.9 |
| CVE-2012-6685 | 7.5 | Feb 19 | Nokogiri before 1.5.4 is vulnerable to XXE attacks Affected: 5.0 |
| CVE-2017-2639 | 7.5 | Jul 27 | It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat… Affected: 5.8 |
| CVE-2013-2049 | 7.5 | May 1 | Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret Affected: 2.0 |
| CVE-2016-4457 | 7.5 | Jun 8 | CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate Affected: 5.7 |
| CVE-2019-14894 | 7.2 | Jun 22 | A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup Affected: 5.10; 5.11 |
| CVE-2020-14296 | 7.1 | Aug 11 | Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw Affected: 4.7; 5.0 |
Showing 13