bandit

.. image:: https://raw.githubusercontent.com/pycqa/bandit/main/logo/logotype-sm.png :alt: Bandit ====== .. image:: https://github.com/PyCQA/bandit/actions/workflows/pythonpackage.yml/badge.svg?branch=main :target:...

CVE-2017-18635

cve-2017-18635 PoC for CVE-2017-18635 Full article: Exploiting an old noVNC XSS CVE-2017-18635 in OpenStack...

Nova noVNC - Open Redirect

Nova noVNC contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-3654 info: name: Nova noVNC - Open Redirect author: geeknik severity: medium...

brawl-public-game-001

BRAWL サイバーセキュリティ研究者が検出・対応能力を開発する際の課題の一つは、仮説や能力をテストするための現実的な環境を見つけることです。...

CVE-2013-0212

CVE-2013-0212 Verison: https://github.com/openstack/glance/tree/4b768a4a847a0f5c857f4fe3f3bca720da9b3949...

CVE-2013-2006

CVE-2013-2006 Version: https://github.com/openstack/keystone/blob/d43e2a51a1ed7adbed3c5ddf001d46bc4a824ae8...

CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

EUVD-2026-83275

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and DELETE /v2/leases/leaseid. The policy authorize wrapper attempts to load the target lease to build the authorization target from its owner...

CVE-2026-93854

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and DELETE /v2/leases/leaseid. The policy authorize wrapper attempts to load the target lease to build the authorization target from its owner...

CVE-2026-93854

In OpenStack Blazar before 17.0.1 , the V2 lease API fails to enforce object-level authorization on update and delete operations due to a parameter name mismatch : the authorize() wrapper looks up the lease under the keyword "lease_id" while the controller methods name the parameter "id" (deliver...

CVE-2026-93852

OpenStack Blazar before 17.0.1 has a broken authorization flaw in the V2 lease listing endpoint (GET /v2/leases). The endpoint returns leases for every project without enforcing project scoping or an administrator-only policy, allowing any authenticated user with REST API access to enumerate leas...

EUVD-2026-83273

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

syntribos

======================== Team and repository tags .. image:: http://governance.openstack.org/badges/syntribos.svg :target: http://governance.openstack.org/reference/tags/index.html .. image:: http://img.shields.io/badge/docs-latest-brightgreen.svg?style=flat :target:...

CVE-2026-71198

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...

CVE-2026-71198

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...

EUVD-2026-77315

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...

CVE-2026-71198

CVE-2026-71198 is a server-side request forgery (SSRF) in OpenStack Glance before 32.0.1 . When the HTTP store backend is enabled, the location API validates only the URL scheme but does not apply import_filtering_opts host restrictions. An authenticated user can add an image location pointing to...

Linux Distros Unpatched Vulnerability : CVE-2026-90460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAut...

Linux Distros Unpatched Vulnerability : CVE-2026-90461

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...