648 matches found
CVE-2014-7851: Undefined Security Weakness
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user...
PT-2017-6113 · Red Hat · Ovirt
Name of the Vulnerable Software and Affected Versions: oVirt versions 3.2.2 through 3.5.0 Description: The issue allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user, due to the...
CVE-2014-8170
ovirtsafedeleteconfig in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users and physically proximate attackers to execute arbitrary...
CVE-2014-8170: Use of Externally-Controlled Format String
ovirtsafedeleteconfig in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users and physically proximate attackers to execute arbitrary...
CVE-2014-8170
ovirtsafedeleteconfig in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users and physically proximate attackers to execute arbitrary...
CVE-2014-8170
CVE-2014-8170 affects ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3. The issue stems from ovirt_safe_delete_config in ovirtfunctions.py (and other locations) not properly quoting input strings, enabling arbitrary command execution when a semicolon is included in...
CVE-2014-8170
ovirtsafedeleteconfig in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users and physically proximate attackers to execute arbitrary...
PT-2017-6156 · Red Hat · Red Hat Enterprise Virtualization +1
Name of the Vulnerable Software and Affected Versions: ovirt-node version 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 Description: The issue arises from the ovirt safe delete config function in ovirtfunctions.py and other unspecified locations, which fails to properly...
CVE-2016-6310
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
Session fixation
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
CVE-2016-6310
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
CVE-2016-6310
CVE-2016-6310 affects oVirt Engine (RHEV before 4.0). The vulnerability involves a information disclosure where ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD is exposed in /var/log/ovirt-engine/engine.log. The connected sources confirm the issue without detailing exploitation steps, affected versions bey...
CVE-2016-6310
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
CVE-2016-6310
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
PT-2017-8958
Name of the Vulnerable Software and Affected Versions oVirt Engine versions prior to 4.0 Description The issue concerns the disclosure of sensitive information, specifically the ENGINE HTTPS PKI TRUST STORE PASSWORD, which is logged in the /var/log/ovirt-engine/engine.log file. This affects oVirt...
CVE-2016-6310: Exposure of Sensitive Information to an Unauthorized Actor
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
CVE-2016-3113
Cross-site scripting XSS vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML...
CVE-2016-3113
Cross-site scripting XSS vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML...
CVE-2016-3113
CVE-2016-3113 is a cross-site scripting vulnerability in the ovirt-engine web UI. The vulnerability allows remote attackers to inject arbitrary web script or HTML. Affected: ovirt-engine (web UI) component; root cause relates to input handling enabling script/HTML injection. Impact stated by NVD:...