PT-2017-8342

Name of the Vulnerable Software and Affected Versions oVirt Engine affected versions not specified Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to unauthorized actions on the affected system. Recommendations At th...

CVE-2016-3113: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML...

PT-2017-8721

Name of the Vulnerable Software and Affected Versions Red Hat QuickStart Cloud Installer QCI versions prior to 1.0 GA Description The issue concerns a file, /var/lib/ovirt-engine/setup/engine-DC-config.py, created by Red Hat QuickStart Cloud Installer QCI that is world readable and contains the...

Red Hat oVirt Engine Denial of Service Vulnerability

Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . A denial of service vulnerability exists in the...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

Design/Logic Flaw

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-3077

CVE-2016-3077 affects oVirt Engine via the VersionMapper.fromKernelVersionString method. The vulnerability allows remote authenticated users to trigger a denial of service (process crash) affecting all VMs. No exploitation vector or exploit details are provided in the supplied documents. Remediat...

CVE-2016-3077

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

PT-2017-8325

Name of the Vulnerable Software and Affected Versions oVirt Engine affected versions not specified Description The issue allows remote authenticated users to cause a denial of service, resulting in a process crash for all VMs, by exploiting the VersionMapper.fromKernelVersionString method...

CVE-2016-3077: Improper Restriction of Operations within the Bounds of a Memory Buffer

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service process crash for all VMs...

CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

Design/Logic Flaw

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

Default credentials

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...