Cloudforms 3.0 Management Engine

cloudforms_3.0_management_engine

Vendor: Redhat • 13 CVEs

CVEs (13)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-7813 1Redhat 1Cloudforms 3.0 Management Engine May 13, 2026 Oct 18, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym rails function and lack of garbage collection...Show more Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym rails function and lack of garbage collection of inserted symbols.Show less
CVE-2014-0136 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
CVE-2014-3642 1Redhat 6Cloudforms 3.0.1 Management Engine Cloudforms 3.0.2 Management EngineCloudforms 3.0.3 Management Engine+3 more May 6, 2026 Oct 6, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecu...Show more vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method."Show less
CVE-2014-0140 1Redhat 6Cloudforms 3.0.1 Management Engine Cloudforms 3.0.2 Management EngineCloudforms 3.0.3 Management Engine+3 more May 6, 2026 Oct 6, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request.
CVE-2014-3489 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 Jul 7, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.
CVE-2014-3486 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 Jul 7, 2014 N/A· v4 N/A· v3 6.9 MEDIUM· v2 The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary...Show more The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.Show less
CVE-2014-0184 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 Jul 7, 2014 N/A· v4 N/A· v3 4.9 MEDIUM· v2 Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.
CVE-2014-0180 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 Jul 7, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consum...Show more The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.Show less
CVE-2014-0176 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 Jul 7, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-0137 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 May 14, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via...Show more SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.Show less
CVE-2014-0078 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 May 14, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.
CVE-2014-0057 1Redhat 2Cloudforms Cloudforms 3.0 Management Engine May 6, 2026 Mar 18, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.
CVE-2013-6443 1Redhat 2Cloudforms Cloudforms 3.0 Management Engine Apr 29, 2026 Jan 23, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a reque...Show more CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.Show less