Redhat Ovirt-engine
10 CVEs affecting Redhat Ovirt-engine. Latest disclosed: 2020-08-24. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7510 | High | 8.8 | 2019-03-25 | In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface. |
CVE-2014-7851 | High | 7.5 | 2017-10-16 | oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of ano… |
CVE-2015-1780 | Medium | 6.5 | 2019-11-22 | oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center |
CVE-2016-3077 | Medium | 6.5 | 2017-06-06 | The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs. |
CVE-2016-3113 | Medium | 6.1 | 2017-08-07 | Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML. |
CVE-2020-10775 | Medium | 5.3 | 2020-08-24 | An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites an… |
CVE-2018-1062 | Medium | 5.3 | 2018-03-06 | A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt… |
CVE-2018-1000095 | Medium | 4.8 | 2018-03-13 | oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting (XSS) vulnerability in the name/description of VMs portion of the web admin application. This vuln… |
CVE-2014-0151 | | 2015-02-13 | Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests t… | |
CVE-2014-0152 | | 2014-09-08 | Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors. |