Red Hat CloudForms 3.0 Management Engine 5.2.1

CPE Details

Red Hat CloudForms 3.0 Management Engine 5.2.1
redhat
cloudforms_3.0_management_engine
5.2.1
2014-01-23
17h14 +00:00
2014-05-16
13h42 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.1:*:*:*:*:*:*:*

Informations

Vendor

redhat

Product

cloudforms_3.0_management_engine

Version

5.2.1

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2014-0136 2014-10-27 00h00 +00:00 The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
5
CVE-2014-0176 2014-07-07 12h00 +00:00 Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2014-0180 2014-07-07 12h00 +00:00 The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.
5
CVE-2014-0184 2014-07-07 12h00 +00:00 Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.
4.9
CVE-2014-3486 2014-07-07 12h00 +00:00 The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.
6.9
CVE-2014-3489 2014-07-07 12h00 +00:00 lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.
4.3
CVE-2014-0078 2014-05-14 17h00 +00:00 The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.
4
CVE-2014-0137 2014-05-14 17h00 +00:00 SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.
6.5
CVE-2013-6443 2014-01-23 00h00 +00:00 CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.
6.8