274 matches found
ovirt-engine: account enumeration through login to web console
The ovirt-engine web console login form returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...
CVE-2018-1073
The ovirt-engine web console login form returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...
Red Hat ovirt-engine API and administration web portal access privilege acquisition vulnerability
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat, an open source version of RHEV Enterprise Virtualization Platform. oVirt-engine API is one of the management interfaces; administration web portal is one of the web-based management portals. The administration...
Design/Logic Flaw
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...
CVE-2018-1074
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...
CVE-2018-1074
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...
CVE-2018-1074
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...
CVE-2018-1074
CVE-2018-1074 affects ovirt-engine API and administration web portal before versions 4.2.2.5 and 4.1.11.2, exposing Power Management credentials (cleartext passwords) to Host Administrators who control the hosts. This could allow escalation to power-management systems. Connected sources confirm t...
ovirt-engine: API exposes power management credentials to administrators
The ovirt-engine API and administration web portal exposed Power Management credentials including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control...
ovirt-engine: When Wipe After Delete (WAD) and Enable Discard are both enabled for a VM disk, discarded data might not be wiped after the disk is removed.
It was discovered that the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially...
ovirt-engine: webadmin log out must logout all sessions
It was discovered that the ovirt-engine webadmin session would not properly enforce timeouts. Browser sessions would remain logged in beyond the administratively configured session timeout period...
Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2017-38353)
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...
CVE-2017-15113
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...
ovirt-engine: DEBUG logging includes unmasked passwords
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...
Red Hat MRG ovirt-engine certificate validation security bypass vulnerability
Red Hat MRG is a suite of IT infrastructure platforms for integrated high-performance computing HPC from Red Hat, Inc. ovirt-engine is one of the open source virtualization management platform. A security vulnerability exists in ovirt-engine in Red Hat MRG version 3, which stems from the program'...
Code injection
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...
CVE-2014-3706
CVE-2014-3706 affects ovirt-engine (as used in Red Hat MRG 3). The vulnerability stems from failure to verify key attributes in vdsm X.509 certificates, enabling MITM attackers to spoof servers. Public details in the provided documents confirm the issue and its impact on server authentication. Mu...
CVE-2014-3706
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...