303 matches found
CVE-2018-1074
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...
CVE-2018-1074: Exposure of Sensitive Information to an Unauthorized Actor
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...
ovirt-engine: API exposes power management credentials to administrators
The ovirt-engine API and administration web portal exposed Power Management credentials including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control...
ovirt-engine: When Wipe After Delete (WAD) and Enable Discard are both enabled for a VM disk, discarded data might not be wiped after the disk is removed.
It was discovered that the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially...
ovirt-engine: webadmin log out must logout all sessions
It was discovered that the ovirt-engine webadmin session would not properly enforce timeouts. Browser sessions would remain logged in beyond the administratively configured session timeout period...
Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2017-38353)
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...
CVE-2017-15113
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...
ovirt-engine: DEBUG logging includes unmasked passwords
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...
Red Hat MRG ovirt-engine certificate validation security bypass vulnerability
Red Hat MRG is a suite of IT infrastructure platforms for integrated high-performance computing HPC from Red Hat, Inc. ovirt-engine is one of the open source virtualization management platform. A security vulnerability exists in ovirt-engine in Red Hat MRG version 3, which stems from the program'...
Code injection
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...
CVE-2014-3706
CVE-2014-3706 affects ovirt-engine (as used in Red Hat MRG 3). The vulnerability stems from failure to verify key attributes in vdsm X.509 certificates, enabling MITM attackers to spoof servers. Public details in the provided documents confirm the issue and its impact on server authentication. Mu...
CVE-2014-3706
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...
CVE-2014-3706: Improper Certificate Validation
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...
CVE-2016-6310
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
CVE-2016-6310
CVE-2016-6310 affects oVirt Engine (RHEV before 4.0). The vulnerability involves a information disclosure where ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD is exposed in /var/log/ovirt-engine/engine.log. The connected sources confirm the issue without detailing exploitation steps, affected versions bey...
CVE-2016-6310
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
CVE-2016-6310: Exposure of Sensitive Information to an Unauthorized Actor
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
CVE-2016-3113
Cross-site scripting XSS vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML...