CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 11/08/2020 |
| CVE-2020-10780 | 보통6.3 | Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application direc | 11/08/2020 |
| CVE-2019-14894 | 높음7.2 | A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root. | 22/06/2020 |
| CVE-2019-14905 | 보통5.6 | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. Th | 31/03/2020 |
| CVE-2020-1740 | 보통4.7 | A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is | 16/03/2020 |
| CVE-2020-1738 | 낮음3.9 | A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be v | 16/03/2020 |
| CVE-2020-1736 | 낮음3.3 | A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This cou | 16/03/2020 |
| CVE-2020-1735 | 보통4.6 | A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. | 16/03/2020 |
| CVE-2020-1739 | 낮음3.9 | A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on t | 12/03/2020 |
| CVE-2020-1733 | 보통5.0 | A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; | 11/03/2020 |
| CVE-2012-6685 | 높음7.5 | Nokogiri before 1.5.4 is vulnerable to XXE attacks | 19/02/2020 |
| CVE-2019-14864 | 보통6.5 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data. | 02/01/2020 |
| CVE-2014-3536 | 보통5.5 | CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration | 15/12/2019 |
| CVE-2014-0197 | 높음8.8 | CFME: CSRF protection vulnerability via permissive check of the referrer header | 13/12/2019 |
| CVE-2018-10854 | 보통5.4 | cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field. | 22/11/2019 |
| CVE-2013-6461 | 보통6.5 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits | 05/11/2019 |
| CVE-2013-6460 | 보통6.5 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents | 05/11/2019 |
| CVE-2019-10177 | 보통6.5 | A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution an | 27/06/2019 |