274 matches found
CVE-2016-5432
The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization RHEV Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files...
CVE-2016-5432
CVE-2016-5432 affects the ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0. The root cause is that authentication details used with --provision*db outputs were not properly sanitized before being written to log files, potentially exposing sensitive informati...
CVE-2016-5432
The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization RHEV Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files...
PT-2016-6427 · Red Hat · Red Hat Enterprise Virtualization
Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization RHEV Engine version 4.0 Description: The issue allows local users to obtain sensitive database provisioning information. This is achieved by reading log files, specifically those generated by the...
ovirt-engine: ovirt-engine-provisiondb logs contain DB username and password in plain text
It was found that the ovirt-engine-provisiondb utility did not correctly sanitize the authentication details used with the “—provisiondb” options from the output before storing them in log files. This could allow an attacker with read access to these log files to obtain sensitive information such...
Red Hat oVirt Engine Local Information Disclosure Vulnerability
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . A local information disclosure vulnerability exists in...
Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2016-07080)
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...
CVE-2016-5432
It was found that the ovirt-engine-provisiondb utility did not correctly sanitize the authentication details used with the “—provisiondb” options from the output before storing them in log files. This could allow an attacker with read access to these log files to obtain sensitive information such...
Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2016-06917)
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...
Red Hat oVirt Engine Local Security Bypass Vulnerability
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . A local security bypass vulnerability exists in Red Hat...
CVE-2016-6341
oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...
Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2016-06304)
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...
Red Hat oVirt Engine Cross-Site Scripting Vulnerability
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . A cross-site scripting vulnerability exists in Red Hat...
ovirt-engine: Crash of API when parsing unxepected version number
The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...
PT-2015-4547 · Red Hat · Red Hat Enterprise Virtualization
Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization RHEV Manager versions prior to 3.5.1 Description: The issue allows local users to obtain sensitive information by reading files in a directory due to weak permissions on the directories shared by the...
ovirt-engine-dwh: incorrect permissions on plugin file containing passwords
It was discovered that a directory shared between the ovirt-engine-dwhd service and a plug-in used during the service's startup had incorrect permissions. A local user could use this flaw to access files in this directory, which could potentially contain sensitive information...
Red Hat oVirt Engine Information Disclosure Vulnerability
Red Hat oVirt Engine is an open source virtualization management platform, an open source version of RHEV Platform for Enterprise Virtualization, consisting of an oVirt-node client and an overt-engine manager. A security vulnerability exists in Red Hat oVirt Engine 3.4.4 and earlier versions, whe...
CVE-2014-0151
Cross-site request forgery CSRF vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request...
Design/Logic Flaw
oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request...