CVE-2016-3113

Cross-site scripting XSS vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML...

CVE-2016-3113

CVE-2016-3113 is a cross-site scripting vulnerability in the ovirt-engine web UI. The vulnerability allows remote attackers to inject arbitrary web script or HTML. Affected: ovirt-engine (web UI) component; root cause relates to input handling enabling script/HTML injection. Impact stated by NVD:...

CVE-2016-3113: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML...

Design/Logic Flaw

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-3077

CVE-2016-3077 affects oVirt Engine via the VersionMapper.fromKernelVersionString method. The vulnerability allows remote authenticated users to trigger a denial of service (process crash) affecting all VMs. No exploitation vector or exploit details are provided in the supplied documents. Remediat...

CVE-2016-3077: Improper Restriction of Operations within the Bounds of a Memory Buffer

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

Design/Logic Flaw

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

Default credentials

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6341

The CVE affects oVirt Engine prior to 4.0.3. The root cause is that DWH_DB_PASSWORD is not hidden in engine log files, enabling local users to read logs and obtain sensitive password information. Impact is information disclosure affecting confidentiality. The documented remediation is to upgrade ...

CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6341: Exposure of Sensitive Information to an Unauthorized Actor

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6338: Improper Access Control

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...