469 matches found
PT-2013-1813
Name of the Vulnerable Software and Affected Versions Apache CloudStack version 4.0.0-incubating Citrix CloudPlatform formerly Citrix CloudStack versions prior to 3.0.6 Description The issue allows local users to obtain sensitive information, including the SSH private key, and passwords of added...
CVE-2012-5616: Undefined Security Weakness
Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform formerly Citrix CloudStack before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain 1 the SSH private key as recorded by the createSSHKeyPair API, 2 the password of an added host as recorde...
Apache CloudStack本地信息泄露漏洞
BUGTRAQ ID: 57259 CVECAN ID: CVE-2012-5616 Apache CloudStack是部署和管理大型虚拟机网络的开源软件。 Apache CloudStack 4.0.0-incubating及其他版本存在安全漏洞，本地用户可利用此漏洞泄露敏感信息。 1） createSSHKeyPair API命令内存在错误，此命令将新建的SSH密钥存储在日志文件中，可造成密钥泄露。 2）AddHost API呼叫将某些信息记录在日志文件内，可造成泄露已添加主机的密码。 3）DeployVM和ResetPasswordForVM...
CVE-2012-4501
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs...
Code injection
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs...
CVE-2012-4501
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs...
PT-2012-5447
Name of the Vulnerable Software and Affected Versions Citrix Cloud.com CloudStack, and Apache CloudStack pre-release Description The issue allows remote attackers to make arbitrary API calls by leveraging the system user account. This can be demonstrated by API calls to delete VMs. Recommendation...
CVE-2012-4501: Undefined Security Weakness
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs...
