CVE-2016-6310

CVE-2016-6310 affects oVirt Engine (RHEV before 4.0). The vulnerability involves a information disclosure where ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD is exposed in /var/log/ovirt-engine/engine.log. The connected sources confirm the issue without detailing exploitation steps, affected versions bey...

CVE-2016-3113

Cross-site scripting XSS vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML...

CVE-2016-3113

Cross-site scripting XSS vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML...

CVE-2016-3113

CVE-2016-3113 is a cross-site scripting vulnerability in the ovirt-engine web UI. The vulnerability allows remote attackers to inject arbitrary web script or HTML. Affected: ovirt-engine (web UI) component; root cause relates to input handling enabling script/HTML injection. Impact stated by NVD:...

CVE-2016-3113

Cross-site scripting XSS vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

Design/Logic Flaw

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-3077

CVE-2016-3077 affects oVirt Engine via the VersionMapper.fromKernelVersionString method. The vulnerability allows remote authenticated users to trigger a denial of service (process crash) affecting all VMs. No exploitation vector or exploit details are provided in the supplied documents. Remediat...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

Design/Logic Flaw

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

Default credentials

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6341

The CVE affects oVirt Engine prior to 4.0.3. The root cause is that DWH_DB_PASSWORD is not hidden in engine log files, enabling local users to read logs and obtain sensitive password information. Impact is information disclosure affecting confidentiality. The documented remediation is to upgrade ...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

RHEL 7 : ovirt-engine-extension-aaa-jdbc (RHSA-2017:0257)

An update for ovirt-engine-extension-aaa-jdbc is now available for RHEV Engine version 4.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...