Rails Ruby on Rails Path Traversal Vulnerability

CFME: CSRF protection vulnerability via permissive check of the referrer header

A code injection flaw was found in the way capacity and utilization imported control files are processed

It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users

In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that…

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a…

ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code

The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters."

Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw

A flaw was found in Cloudforms

CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to…

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give…

It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat…

There is an information leak vulnerability in Sprockets

A flaw was found in the CloudForms account configuration when using VMware

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory…