CM
Product
Cloudforms Management Engine
42
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 2High 13Medium 21Low 3
Watch
Add Cloudforms Management Engine to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-14864 | 6.5 | Jan 2 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk… Affected: 5.0 |
| CVE-2013-6461 | 6.5 | Nov 5 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits Affected: 5.0 |
| CVE-2013-6460 | 6.5 | Nov 5 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents Affected: 5.0 |
| CVE-2019-10177 | 6.5 | Jun 27 | A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized Affected: 5.9; 5.10 |
| CVE-2017-7528 | 6.5 | Aug 22 | Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection Affected: 5.0 |
| CVE-2017-2653 | 6.5 | Jul 27 | A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests Affected: before 5.7.2.1 |
| CVE-2017-2664 | 6.5 | Jul 26 | CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms Affected: before 5.7.3; 5.8 before 5.8.1 |
| CVE-2020-10780 | 6.3 | Aug 11 | Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel Affected: 4.7; 5.0 |
| CVE-2019-14905 | 5.6 | Mar 31 | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used… Affected: 5.0 |
| CVE-2014-3536 | 5.5 | Dec 15 | CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration Affected: 5.0 |
| CVE-2018-10854 | 5.4 | Nov 22 | cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting Affected: 4.7; 5.8; 5.9 |
| CVE-2017-15125 | 5.4 | Jul 27 | A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input Affected: before 5.9.0.22 |
| CVE-2017-15123 | 5.3 | Jun 12 | A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only Affected: 5.8 through 5.10 |
| CVE-2016-3702 | 5.3 | Apr 21 | Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information Affected: 5.0 |
| CVE-2015-7502 | 5.1 | Apr 11 | Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which… Affected: 5.4.4; 5.5.0 |
| CVE-2020-1733 | 5.0 | Mar 11 | A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user Affected: 5.0 |
| CVE-2017-2632 | 4.9 | Jul 27 | A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant… Affected: before 5.7.1.3 |
| CVE-2020-1740 | 4.7 | Mar 16 | A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files Affected: 5.0 |
| CVE-2020-1735 | 4.6 | Mar 16 | A flaw was found in the Ansible Engine when the fetch module is used Affected: 5.0 |
| CVE-2016-7047 | 4.3 | Sep 11 | A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2 Affected: 5.6 before 5.6.3.0; 5.7 before 5.7.3.1; 5.8 before 5.8.1.2 |
| CVE-2017-7497 | 4.3 | Jul 27 | The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user Affected: 5.7.2; 5.8.0 |
Showing 21