National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

Search Results (Refine Search)

Search Parameters:
  • Contains Software Flaws (CVE)
  • CPE Product Version: cpe:/a:redhat:cloudforms_3.0_management_engine:5.2
There are 12 matching records.
Vuln ID Summary CVSS Severity
CVE-2014-0136

The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.

Published: October 26, 2014; 09:55:24 PM -04:00
V2: 5.0 MEDIUM
CVE-2014-3642

vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method."

Published: October 06, 2014; 10:55:10 AM -04:00
V2: 6.5 MEDIUM
CVE-2014-0140

Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request.

Published: October 06, 2014; 10:55:08 AM -04:00
V2: 4.0 MEDIUM
CVE-2014-3489

lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.

Published: July 07, 2014; 10:55:04 AM -04:00
V2: 4.3 MEDIUM
CVE-2014-3486

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

Published: July 07, 2014; 10:55:04 AM -04:00
V2: 6.9 MEDIUM
CVE-2014-0184

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

Published: July 07, 2014; 10:55:03 AM -04:00
V2: 4.9 MEDIUM
CVE-2014-0180

The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.

Published: July 07, 2014; 10:55:03 AM -04:00
V2: 5.0 MEDIUM
CVE-2014-0176

Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published: July 07, 2014; 10:55:03 AM -04:00
V2: 4.3 MEDIUM
CVE-2014-0137

SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.

Published: May 14, 2014; 03:55:10 PM -04:00
V2: 6.5 MEDIUM
CVE-2014-0078

The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

Published: May 14, 2014; 03:55:10 PM -04:00
V2: 4.0 MEDIUM
CVE-2014-0057

The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.

Published: March 18, 2014; 01:02:52 PM -04:00
V2: 7.5 HIGH
CVE-2013-6443

CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.

Published: January 22, 2014; 08:55:03 PM -05:00
V2: 6.8 MEDIUM