648 matches found
CVE-2019-19336: Improper Neutralization of Input During Web Page Generation
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the...
RHEL 7 : Red Hat Virtualization Engine (RHSA-2020:0498)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0498 advisory. - ovirt-engine: responsetype parameter allows reflected XSS CVE-2019-19336 Note that Nessus has not tested for this issue but has instead relied only...
Cross-site Scripting (XSS)
ovirt-engine is vulnerable to cross-site scripting XSS. The vulnerability exists through the lack of sanitization of the responsetype parameter...
ovirt-engine: response_type parameter allows reflected XSS
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session...
ovirt-engine cross-site scripting vulnerability
ovirt-engine is an open source virtualization management engine. A cross-site scripting vulnerability exists in ovirt-engine. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...
CVE-2019-19336
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session...
oVirt Engine CVE-2019-19336 Cross Site Scripting Vulnerability
Description oVirt Engine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the...
ovirt-engine-sdk-python trust management issue vulnerability
ovirt-engine-sdk-python is a Python-based package that provides access to the oVirt Engine API. A trust management issue vulnerability in ovirt-engine-sdk-python versions prior to 3.4.0.7 and prior to 3.5.0.4, which stems from the program's failure to validate that the hostname of a remote endpoi...
CVE-2014-0161
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...
PYSEC-2020-245
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...
Code injection
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...
PYSEC-2020-245
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...
CVE-2014-0161
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...
CVE-2014-0161
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...
CVE-2014-0161
The CVE-2014-0161 issue affects ovirt-engine-sdk-python prior to 3.4.0.7 and 3.5.0.4, where the client does not verify that the remote host’s certificate hostname matches the CN or subjectAltName in the TLS/SSL certificate. This incomplete hostname validation can enable man-in-the-middle attacks ...
PT-2020-7591
Name of the Vulnerable Software and Affected Versions ovirt-engine-sdk-python versions prior to 3.4.0.7 ovirt-engine-sdk-python versions prior to 3.5.0.4 Description The issue arises from the failure to verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName a...
CVE-2014-0161: Improper Certificate Validation
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...
Important: Red Hat Security Advisory: Red Hat Ansible Tower 3.5.4-1 - RHEL7 Container
Red Hat Ansible Tower 3.5.4-1 - RHEL7 Container Added a command to generate a new SECRETKEY and rekey the database Removed the guest user from the optionally-configured RabbitMQ admin interface CVE-2019-19340 Fixed assorted issues with preserving permissions in the Ansible Tower backup playbook...