CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-6443 – CFME: GET request CSRF vulnerability
https://notcve.org/view.php?id=CVE-2013-6443
CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request. CloudForms 3.0 Management Engine anterior a la versión 5.2.1.6 permite a atacantes remotos evadir el mecanismo protect_from_forgery de Ruby on Rails y llevar a cabo ataques de CSRF a través de una acción destructiva en una petición. • http://rhn.redhat.com/errata/RHSA-2014-0025.html http://www.securitytracker.com/id/1029606 https://access.redhat.com/security/cve/CVE-2013-6443 https://bugzilla.redhat.com/show_bug.cgi?id=1044178 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5604
https://notcve.org/view.php?id=CVE-2012-5604
The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors. La gema ldap_fluff para Ruby, tal y como se emplea en Red Hat CloudForms 1.1, cuando se emplea Active Directory para la autenticación, permite que atacantes remotos omitan la autenticación mediante vectores sin especificar. • http://rhn.redhat.com/errata/RHSA-2013-0544.html https://bugzilla.redhat.com/show_bug.cgi?id=882136 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2012-3538 – katello: pulp admin password logged in plaintext in world-readable katello/production.log
https://notcve.org/view.php?id=CVE-2012-3538
Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administrative passwords by reading production.log. Pulp en Red Hat CloudForms anteriores a v1.1 registra las contraseñas administrativas en un fichero legible, lo que permite a usuarios locales a leer contraseñas administrativas leyendo el fichero production.log. • http://osvdb.org/88139 http://rhn.redhat.com/errata/RHSA-2012-1543.html http://secunia.com/advisories/51472 http://www.securityfocus.com/bid/56819 https://exchange.xforce.ibmcloud.com/vulnerabilities/80547 https://access.redhat.com/security/cve/CVE-2012-3538 https://bugzilla.redhat.com/show_bug.cgi?id=852199 • CWE-255: Credentials Management Errors •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5603 – Katello: lack of authorization in proxies_controller.rb
https://notcve.org/view.php?id=CVE-2012-5603
proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated users to read consumer certificates or change arbitrary users' settings via unspecified vectors related to the "consumer UUID" of a system. proxies_controller.rb en Katello en Red Hat CloudForms anterior a v1.1 no comprueba los permisos de forma adecuada, lo que permite a usuarios remotos autenticados leer certificados de consumidores o cambiar especificaciones de usuarios a través de vectores relacionados con el "consumer UUID"de un system. • http://osvdb.org/88140 http://osvdb.org/88142 http://rhn.redhat.com/errata/RHSA-2012-1543.html http://rhn.redhat.com/errata/RHSA-2013-0544.html http://secunia.com/advisories/51472 http://www.securityfocus.com/bid/56819 https://bugzilla.redhat.com/show_bug.cgi?id=882129 https://exchange.xforce.ibmcloud.com/vulnerabilities/80549 https://access.redhat.com/security/cve/CVE-2012-5603 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5605 – grinder: /var/lib/pulp/cache/grinder directory is world-writeable
https://notcve.org/view.php?id=CVE-2012-5605
Grinder in Red Hat CloudForms before 1.1 uses world-writable permissions for /var/lib/pulp/cache/grinder/, which allows local users to modify grinder cache files. Grinder en Red Hat CloudForms anteriores a v1.1 usa permisos "world-writable" para /var/lib/pulp/cache/grinder/, lo que permite a usuarios locales modificar la caché de los ficheros grinder. • http://osvdb.org/88141 http://rhn.redhat.com/errata/RHSA-2012-1543.html http://secunia.com/advisories/51472 http://www.securityfocus.com/bid/56819 https://bugzilla.redhat.com/show_bug.cgi?id=828447 https://bugzilla.redhat.com/show_bug.cgi?id=882138 https://exchange.xforce.ibmcloud.com/vulnerabilities/80550 https://access.redhat.com/security/cve/CVE-2012-5605 • CWE-264: Permissions, Privileges, and Access Controls •