Skip to content
OpenAdvisories
High 1 exploited CVE RHSA-2014:0816 7 CVEs

Red Hat Security Advisory: cfme security, bug fix, and enhancement update

Published Sep 15, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · CloudForms 5 cloudforms_managementengine:5::el6 cfme 0:5.2.4.2-1.el6cf
Red Hat · CloudForms 5 cloudforms_managementengine:5::el6 cfme-appliance 0:5.2.4.2-1.el6cf
Red Hat · CloudForms 5 cloudforms_managementengine:5::el6 cfme-debuginfo 0:5.2.4.2-1.el6cf
Red Hat · CloudForms 5 cloudforms_managementengine:5::el6 cfme-lib 0:5.2.4.2-1.el6cf
Red Hat · CloudForms 5 cloudforms_managementengine:5::el6 mingw32-cfme-host 0:5.2.4.2-1.el6cf
Red Hat · CloudForms 5 cloudforms_managementengine:5::el6 ruby193-rubygem-actionpack 1:3.2.13-8.el6cf

Vulnerabilities 7

  • High 7.5
    CVE-2014-0130 Exploited Public exploit EPSS 54%

    actionpack Path Traversal vulnerability

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows re…

    actionpack RubyGems
    KEV Mar 25, 2022
  • Unscored —
    CVE-2014-0176

    Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before…

  • Unscored —
    CVE-2014-0180

    The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CF…

  • Unscored —
    CVE-2014-0184

    Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows…

  • Unscored —
    CVE-2014-0197

    CFME: CSRF protection vulnerability via permissive check of the referrer header

    CFME CFME
  • Unscored —
    CVE-2014-3486

    The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in R…

  • Unscored —
    CVE-2014-3489

    lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, whic…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1086463
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1087909
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1089131
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1095105
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1107528
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1107853
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0816.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-0130
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0130
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0130
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • report
    https://access.redhat.com/security/cve/CVE-2014-0176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0176
  • report
    https://access.redhat.com/security/cve/CVE-2014-0180
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0180
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0180
  • report
    https://access.redhat.com/security/cve/CVE-2014-0184
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0184
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0184
  • report
    https://access.redhat.com/security/cve/CVE-2014-0197
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1092875
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0197
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0197
  • report
    https://access.redhat.com/security/cve/CVE-2014-3486
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3486
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3486
  • report
    https://access.redhat.com/security/cve/CVE-2014-3489
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3489
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3489