Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
redhat cloudforms management engine vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2013-6443
CloudForms 3.0 Management Engine prior to 5.2.1.6 allows remote malicious users to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.
Redhat Cloudforms 3.0
Redhat Cloudforms 3.0 Management Engine 5.2
Redhat Cloudforms 3.0 Management Engine
7.2
CVSSv3
CVE-2019-14894
A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on t...
Redhat Cloudforms Management Engine 5.10
Redhat Cloudforms Management Engine 5.11
7.1
CVSSv3
CVE-2020-14296
Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible.
Redhat Cloudforms Management Engine 4.7
Redhat Cloudforms Management Engine 5.0
6.3
CVSSv3
CVE-2020-10780
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an...
Redhat Cloudforms Management Engine 4.7
Redhat Cloudforms Management Engine 5.0
6.5
CVSSv3
CVE-2019-10177
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which c...
Redhat Cloudforms Management Engine 5.10
Redhat Cloudforms Management Engine 5.9
6.5
CVSSv3
CVE-2017-2664
CloudForms Management Engine (cfme) prior to 5.7.3 and 5.8.x prior to 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate...
Redhat Cloudforms Management Engine
Redhat Cloudforms 4.6
Redhat Cloudforms 4.2
8.8
CVSSv3
CVE-2014-0197
CFME: CSRF protection vulnerability via permissive check of the referrer header
Redhat Cloudforms 3.0
Redhat Cloudforms Management Engine
8.8
CVSSv3
CVE-2017-7530
In CloudForms Management Engine (cfme) prior to 5.7.3 and 5.8.x prior to 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execut...
Redhat Cloudforms Management Engine
Redhat Cloudforms 4.5
6.5
CVSSv3
CVE-2017-2653
A number of unused delete routes are present in CloudForms prior to 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an malicious user to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would...
Redhat Cloudforms Management Engine
Redhat Cloudforms 4.2
7.5
CVSSv3
CVE-2017-2639
It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an malicious user to spoof RHEV or OpenShift systems and po...
Redhat Cloudforms 4.5
Redhat Cloudforms Management Engine 5.8
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
brute force
CVE-2024-24908
open redirect
CVE-2024-31497
CVE-2023-45866
CVE-2024-4135
CVE-2024-25523
cache poisoning
CVE-2024-4649
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
NEXT »