Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
redhat cloudforms vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2012-3503
The installation script in Katello 1.0 and previous versions does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote malicious users to authenticate to the CloudForms System Engi...
Theforeman Katello
Redhat Enterprise Linux Server 6.0
9.1
CVSSv3
CVE-2014-8164
A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x.
Redhat Cloudforms Management Engine 5.0
9.1
CVSSv3
CVE-2020-14324
A high severity vulnerability was found in all active versions of Red Hat CloudForms prior to 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This fla...
Redhat Cloudforms Management Engine
9.1
CVSSv3
CVE-2020-14325
Red Hat CloudForms prior to 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious malicious user to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator,...
Redhat Cloudforms
8.8
CVSSv3
CVE-2014-0197
CFME: CSRF protection vulnerability via permissive check of the referrer header
Redhat Cloudforms 3.0
Redhat Cloudforms Management Engine
8.8
CVSSv3
CVE-2019-8324
An issue exists in RubyGems 2.6 and later up to and including 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinsta...
Rubygems Rubygems
Debian Debian Linux 9.0
Opensuse Leap 15.0
Opensuse Leap 15.1
Redhat Enterprise Linux 8.0
8.8
CVSSv3
CVE-2017-7530
In CloudForms Management Engine (cfme) prior to 5.7.3 and 5.8.x prior to 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execut...
Redhat Cloudforms Management Engine
Redhat Cloudforms 4.5
8.3
CVSSv3
CVE-2020-10783
Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files.
Redhat Cloudforms 4.7
Redhat Cloudforms 5.0.0
8.1
CVSSv3
CVE-2020-25716
A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-1...
Redhat Cloudforms
7.5
CVSSv3
CVE-2012-6685
Nokogiri prior to 1.5.4 is vulnerable to XXE attacks
Nokogiri Nokogiri
Redhat Cloudforms Management Engine 5.0
Redhat Enterprise Mrg 2.0
Redhat Openshift 2.0
Redhat Openstack 4.0
Redhat Openstack 6.0
Redhat Openstack Foreman -
Redhat Satellite 6.0
Redhat Subscription Asset Manager -
1 Article
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463
CVE-2024-29895
inject
CVE-2023-52689
CVE-2024-5049
CVE-2024-5051
privilege escalation
physical
CVE-2023-52676
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
6
NEXT »