Product:

Cloudforms

(Redhat)
Date ID Summary Products Score Patch
2018-07-03 CVE-2018-10855 Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. Ubuntu_linux, Debian_linux, Ansible_engine, Cloudforms, Openstack, Virtualization N/A
2019-12-13 CVE-2014-0197 CFME: CSRF protection vulnerability via permissive check of the referrer header Cloudforms, Cloudforms_management_engine N/A
2019-11-04 CVE-2013-4423 CloudForms stores user passwords in recoverable format Cloudforms N/A
2019-11-01 CVE-2013-0186 Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Cloudforms, Manageiq_enterprise_virtualization_manager N/A
2019-03-27 CVE-2019-5418 There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed. Debian_linux, Cloudforms, Rails 7.5
2018-06-26 CVE-2018-3760 There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. Debian_linux, Cloudforms, Enterprise_linux, Sprockets 7.5
2018-11-30 CVE-2018-16476 A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1. Cloudforms, Rails 7.5
2018-05-02 CVE-2018-1104 Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server. Ansible_tower, Cloudforms 8.8
2018-05-02 CVE-2018-1101 Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system. Ansible_tower, Cloudforms 7.2
2018-07-24 CVE-2018-10905 CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user. Cloudforms, Cloudforms_management_engine 7.8