In ManageIQ product there was found an improper input validation vulnerability in expression engine allowing to trigger code execution. The issue was found to be exploitable both via JSON API, which can be triggered by users authorized with GET/read access to a collection in API, and via UI when filtering on VMs based on regular expression, which can be triggered by users able to view and filter on VMs in UI.
Acknowledgments: Name: Tim Wade (Red Hat)
This issue has been addressed in the following products: CloudForms Management Engine 5.6 Via RHSA-2016:1996 https://rhn.redhat.com/errata/RHSA-2016-1996.html