SUSE CVE-2014-8124

OpenStack Dashboard Horizon before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page...

SUSE CVE-2014-8578

Cross-site scripting XSS vulnerability in the Groups panel in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475...

SUSE CVE-2015-3219

Cross-site scripting XSS vulnerability in the Orchestration/Stack section in OpenStack Dashboard Horizon 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handl...

SUSE CVE-2015-3988

Multiple cross-site scripting XSS vulnerabilities in OpenStack Dashboard Horizon 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a 1 Glance image, 2 Nova flavor or 3 Host Aggregate...

SUSE CVE-2016-4428

Cross-site scripting XSS vulnerability in OpenStack Dashboard Horizon 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form...

SUSE CVE-2017-7400

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

SUSE CVE-2019-5544

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8...

SUSE CVE-2020-29565

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provid...

SUSE CVE-2022-1655

An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and...

SUSE CVE-2022-34302

A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader...

CVE-2022-4133

Rejected reason: We were unable to verify this vulnerbility...

Malicious code in dhf-horizon-synthesis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d0e466c39876ba9752607bd8ccc4136123ba9cf5a279337f4e5930c07d203f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Use-After Free

python-django-horizon is vulnerable to Use-After Free. An Incorrect Permission Assignment for Critical Resource flaw allows Horizon session cookies to be created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files...

Malicious code in fca-horizon-mod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7232077e158d7a1dab872f9a53e74ded24fe4fd59bfa9339ab696265b6634e13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-397 Malicious code in fca-horizon-mod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7232077e158d7a1dab872f9a53e74ded24fe4fd59bfa9339ab696265b6634e13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

FBI Says North Korean Hackers Behind $100 Million Horizon Bridge Crypto Theft

The U.S. Federal Bureau of Investigation FBI on Monday confirmed that North Korean threat actors were responsible for the theft of $100 million in cryptocurrency assets from Harmony Horizon Bridge in June 2022. The law enforcement agency attributed the hack to the Lazarus Group and APT38 aka...

console 跨站脚本漏洞

console is a software application. tokio-console prototype A cross-site scripting vulnerability exists in console, which stems from some unknown functionality in the file horizon/static/horizon/js/horizon.instances.js that is manipulated to cause cross-site scripting...

PT-2023-10148 · Unknown · Yanheven Console

Name of the Vulnerable Software and Affected Versions: yanheven console affected versions not specified Description: A vulnerability was found in the yanheven console, classified as problematic, affecting some unknown functionality of the file horizon/static/horizon/js/horizon.instances.js. The...

SUSE-SU-2023:0070-1 Security update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp

This update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp fixes the following issues: Security fixes included on this update: openstack-barbican: - CVE-2022-3100: Fixed an access policy bypass via query string injection...

OpenStack Horizon 跨站脚本漏洞

OpenStack Horizon is a Django-based project for OpenStack designed to provide complete OpenStack dashboards and an extensible framework for building new dashboards from reusable components. A cross-site scripting vulnerability exists in OpenStack Horizon. An attacker could exploit this...