CVE-2014-0151

The CVE-2014-0151 CSRF flaw affects oVirt Engine prior to 3.5.0 beta2, enabling a remote attacker to hijack a legitimate user’s session by crafting a page that triggers REST API actions. Root cause is a CSRF vulnerability in the oVirt REST API, with the trusted session reused for unintended reque...

CVE-2014-0151

Cross-site request forgery CSRF vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request...

CVE-2014-0154

oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2014-0154

CVE-2014-0154 affects oVirt Engine before 3.5.0. The vulnerability stems from not setting the HttpOnly flag in the Set-Cookie header for session IDs, enabling potential script access to the cookie and remote session hijacking if an attacker can reach the user’s browser. Public documents confirm t...

PT-2015-3597 · Ovirt · Ovirt Engine

Name of the Vulnerable Software and Affected Versions: oVirt Engine versions prior to 3.5.0 Description: The issue allows remote attackers to obtain potentially sensitive information via script access to session IDs due to the missing HTTPOnly flag in the Set-Cookie header. Recommendations: For...

CVE-2014-3573

The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML Externa...

Xxe

The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML Externa...

CVE-2014-3573

The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML Externa...

CVE-2014-3573

CVE-2014-3573 affects the oVirt Engine back end module used in Red Hat Enterprise Virtualization Manager prior to 3.4.2. The issue arises from an insecure DocumentBuilderFactory when loading XML/RSDL documents, enabling XML External Entity (XXE) attacks that could allow a remote attacker to read ...

PT-2014-5400 · Red Hat · Red Hat Enterprise Virtualization Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager versions prior to 3.4.2 Description: The issue is related to an XML External Entity XXE problem, where the oVirt Engine backend module uses an insecure DocumentBuilderFactory. This allows remote...

Engine: XML eXternal Entity (XXE) flaw in backend module

It was discovered that, when loading XML/RSDL documents, the oVirt Engine back end module used an insecure DocumentBuilderFactory. A remote, authenticated attacker could use this flaw to read files accessible to the user running the ovirt-engine server, and potentially perform other more advanced...

CVE-2014-3485

The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization rhevm 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity XXE issue...

CVE-2014-3485

The CVE-2014-3485 issue affects oVirt’s ovirt-engine REST API (RHEV/RHEVM 3.4). Affected component: REST API handling within the ovirt-engine/JBoss server. Root cause: XML External Entity (XXE) processing flaw in XML API calls. Impact: remote authenticated users could read arbitrary files accessi...

ovirt-engine-api: XML eXternal Entity (XXE) flaw

The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization rhevm 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity XXE issue...

ovirt-engine-webadmin: session fixation

Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2014-0202

The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse rhevm-dwh package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file...

Design/Logic Flaw

The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse rhevm-dwh package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file...

CVE-2014-0202

The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse rhevm-dwh package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file...

CVE-2014-0202

CVE-2014-0202 affects ovirt-engine-dwh in rhevm-dwh prior to 3.3.3. The setup script stores the history database password in cleartext to a world-readable file, allowing local users to read sensitive information. Red Hat RHSA-2014:0559 advises updating to rhevm-dwh 3.3.3 (or later) to fix the iss...

PT-2014-3532 · Ovirt · Ovirt-Engine-Dwh

Name of the Vulnerable Software and Affected Versions: ovirt-engine-dwh versions prior to 3.3.3 Description: The issue allows local users to obtain sensitive information by reading an unspecified file, as the setup script stores the history database password in cleartext. Recommendations: For...