Red Hat Security Advisory

RHSA-2019:0212

CloudForms 4.7 security, bug fix and enhancement update

Released 2019-02-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

CloudForms Management Engine 5.10 ansible-runner-1.1.2-2.el7ar, ansible-tower-3.3.3-1.el7at, ansible-tower-server-3.3.3-1.el7at +47

TI-2012-05390 CVE-2012-6685 · GHSA-6wj9-77wq-jq7p

LOW 37

Nokogiri before 1.5.4 is vulnerable to XXE attacks

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02168 Published 2020-02-19 Partial fix · 1.5.4 CWE-776

TI-2018-08315 CVE-2018-11627 · GHSA-mq35-wqvf-r23c

LOW 31

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02159 Published 2018-05-31 Fixed in 2.0.2 CWE-79

TI-2018-05825 CVE-2018-8048 · GHSA-x7rv-cr6v-4vm4

LOW 31

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01925 Published 2018-03-27 Fixed in 2.2.1, 1.8.3 CWE-79

TI-2018-02738 CVE-2018-3741 · GHSA-px3r-jm9g-c8w8

LOW 30

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01253 Published 2018-03-30 Partial fix · 1.0.4 CWE-79