CVE-2014-3594: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name...

PT-2014-8627

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions prior to 2013.2.4 OpenStack Dashboard Horizon versions 2014.1 prior to 2014.1.2 OpenStack Dashboard Horizon Juno versions prior to Juno-2 Description A cross-site scripting XSS issue exists in the Groups...

CVE-2013-4471

The Identity v3 API in OpenStack Dashboard Horizon before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user...

PT-2014-2801

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions prior to 2013.2 Description The issue allows remote attackers to change a user's password without requiring the current password, making it easier for them to gain unauthorized access to user accounts. This...

CVE-2014-0157

Cross-site scripting XSS vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard aka Horizon 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template...

CVE-2013-6858

Multiple cross-site scripting XSS vulnerabilities in OpenStack Dashboard Horizon 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to 1 "Volumes" or 2 "Network Topology" page...

CVE-2013-6858: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OpenStack Dashboard Horizon 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to 1 "Volumes" or 2 "Network Topology" page...

PT-2013-6149

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions 2013.2 and earlier Description The issue allows local users to inject arbitrary web script or HTML via an instance name to the "Volumes" or "Network Topology" page, which can lead to cross-site scripting XS...

CVE-2012-3540

Open redirect vulnerability in views/authforms.py in OpenStack Dashboard Horizon Essex 2012.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally assigned CVE-2012-3542 by...

CVE-2012-3540: Improper Input Validation

Open redirect vulnerability in views/authforms.py in OpenStack Dashboard Horizon Essex 2012.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally assigned CVE-2012-3542 by...

PT-2012-3803

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions folsom-1 and 2012.1 and earlier Description The issue is related to a cross-site scripting XSS vulnerability in the refresh mechanism of the log viewer. This vulnerability allows remote attackers to inject...

PT-2012-3834

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions folsom-1 through 2012.1 Description A session fixation issue allows remote attackers to hijack web sessions via the sessionid cookie. Recommendations For OpenStack Dashboard Horizon versions folsom-1 throug...

PT-2012-6309

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions folsom-1 through 2012.1 Description A session fixation issue allows remote attackers to hijack web sessions via the sessionid cookie. Recommendations For OpenStack Dashboard Horizon versions folsom-1 throug...

CVE-2012-2144: Undefined Security Weakness

Session fixation vulnerability in OpenStack Dashboard Horizon folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the sessionid cookie...

CVE-2012-2094: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard Horizon folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console...

PT-2012-6308

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions folsom-1 and 2012.1 and earlier Description A cross-site scripting XSS issue exists in the log viewer's refresh mechanism, allowing remote attackers to inject arbitrary web script or HTML via the guest...