Spoofing Metadata Requests

tripleo-heat-templates is vulnerable to spoofing of metadata requests. It is due to having the bad default setting of a blank value for the NeutronMetadataProxySharedSecret parameter when it is deployed from the command line interface. Not setting the value to this parameter means Neutron does no...

Unauthenticated Access To Private Data

tripleo-heat-templates is susceptible to unauthenticated access to private data. The vulnerability is due to a flaw in the ordering of the staticweb middleware in the swiftproxy configuration pipeline generated from the tripleo-heat-templates package. The staticweb middleware should be put after...

Cross-site Scripting (XSS)

python-django-horizon is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the Orchestration/Stack section in OpenStack Dashboard Horizon 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the descriptio...

Information Disclosure

openstack-heat is vulnerable to information disclosure attacks. The vulnerability exists as OpenStack Orchestration API Heat 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL...

Cross-site Scripting (XSS)

django-horizon is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote...

Authorization Bypass

openstack-heat is vulnerable to authorization bypass attacks. The vulnerability exists as the cloudformation-compatible API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to...

Cross-site Scripting (XSS)

OpenStack Dashboard horizon is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the description field of a Heat template...

Security Bulletin: OpenStack Heat vulnerability affect IBM Cloud Manager with OpenStack (CVE-2016-9185)

Summary IBM Cloud Manager has addressed a vulnerability in OpenStack Heat. Vulnerability Details CVE-ID: CVE-2016-9185 DESCRIPTION: OpenStack Heat could allow a remote authenticated attacker to obtain sensitive information. By using a special-crafted URL, a remote attacker could exploit this...

openstack-tripleo-heat-templates hard-coded credentials vulnerability

openstack-tripleo-heat-templates is a template for deploying the OpenStack platform. A security vulnerability exists in versions prior to openstack-tripleo-heat-templates 8.0.2-40, where Opendaylight in RHOSP13 is configured with default credentials that can be easily guessed when deploying with...

Insecure Default Configuration

tripleoheattemplates is vulnerable to insecure default configuration. The vulnerabilty exists due to the default configuration set for the OpenDayLight ODL admin users' credentials, allowing malicious users to gain unauthorized access...

Default credentials

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

UBUNTU-CVE-2018-10898

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

PYSEC-2018-102

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

PYSEC-2018-102

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

CVE-2018-10898

CVE-2018-10898 affects openstack-tripleo-heat-templates prior to 8.0.2-40. When deploying with Director in RHOSP13, Opendaylight is configured with easily guessable default credentials, as described in multiple sources (Red Hat RHSA-2018:2214 and CNVD/OSV entries). The issue arises from default c...

UBUNTU-CVE-2017-2621

An access-control flaw was found in the OpenStack Orchestration heat service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information...

CVE-2017-2621

The CVE-2017-2621 issue affects OpenStack Orchestration (Heat) prior to 8.0.0 (and 6.1.0, 7.0.2 in older branches): a service log directory was world-readable, allowing a local attacker to access sensitive information. Connected advisories confirm Heat-related fixes and updates (e.g., RHSA notes ...

PT-2018-7142 · Openstack · Openstack Orchestration (Heat) Service

Name of the Vulnerable Software and Affected Versions: OpenStack Orchestration heat service versions prior to 8.0.0 OpenStack Orchestration heat service version 6.1.0 OpenStack Orchestration heat service version 7.0.2 Description: An access-control flaw was found in the OpenStack Orchestration he...

Important: Red Hat Security Advisory: openstack-tripleo-heat-templates security update

An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 13.0 Queens for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

HackRF Circuit Board - New Universal Case for PenTests

Document Title: =============== HackRF Circuit Board - New Universal Case for PenTests References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2134 Download: https://www.vulnerability-lab.com/resources/documents/2134.rar Vulnerability Magazine:...