Cfme

This hub aggregates every CVE we track for Cfme, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 9 most recently published vulnerabilities affecting Cfme.

• CVE-2014-0197CFME: CSRF protection vulnerability via permissive check of the referrer header8.8Dec 13, 2019
• CVE-2019-10159cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivilege...4.3Jun 14, 2019
• CVE-2016-5402A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could ...8.8Oct 31, 2018
• CVE-2016-7047A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tena...4.3Sep 11, 2018
• CVE-2016-7071It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute a...8.8Sep 10, 2018
• CVE-2017-2632A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should hav...4.9Jul 27, 2018
• CVE-2017-7497The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage ...4.1Jul 27, 2018
• CVE-2017-7530In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will...8.8Jul 26, 2018
• CVE-2018-10905CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to...7.8Jul 24, 2018