PT-2022-10437 · Qualcomm · Snapdragon Connectivity +3

Name of the Vulnerable Software and Affected Versions: Snapdragon Compute affected versions not specified Snapdragon Connectivity affected versions not specified Snapdragon Industrial IOT affected versions not specified Snapdragon Mobile affected versions not specified Description: The issue is...

PT-2022-10441 · Qualcomm · Snapdragon Connectivity +4

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to memory corruption in the DSP service due to improper validation of input parameters. This affects various Qualcomm Snapdragon products, including...

PT-2022-10394 · Qualcomm · Snapdragon Auto +4

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions affected versions not specified Description: The issue is related to improper validation of the rank restriction field, which may lead to a possible assertion. This affects various Qualcomm Snapdragon products,...

Virtuozzo Hybrid Infrastructure 5.1 (5.1.0-206)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance service providers' interoperability and help to expand their services. The improvements cover compute services, security, core storage, and the user interface. Additionally, this release delivers...

Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability

A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineClouddoProvision could be used to provision new agents. Google Compute Engine Plugin 4.2.0 requires POST requests for this API endpoint...

GHSA-X24M-WR2F-P3VC Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability

A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineClouddoProvision could be used to provision new agents. Google Compute Engine Plugin 4.2.0 requires POST requests for this API endpoint...

GHSA-345P-PW5Q-G98V Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Google Compute Engine Plugin 4.2.0 verifies SSH host keys before executing any commands on agents...

Jenkins Google Compute Engine Plugin Missing Authorization vulnerability

Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. Google Compute Engine Plugin 4.2.0 requires the appropriate...

GHSA-V98H-RV7J-HF6J Jenkins Google Compute Engine Plugin Missing Authorization vulnerability

Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. Google Compute Engine Plugin 4.2.0 requires the appropriate...

Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Google Compute Engine Plugin 4.2.0 verifies SSH host keys before executing any commands on agents...

Jenkins Oracle Cloud Infrastructure Compute Classic Plugin cross-site request forgery vulnerability

Jenkins Oracle Cloud Infrastructure Compute Classic Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password...

GHSA-M454-CM7H-RQHH OpenStack Nova Directory traversal vulnerability

Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute Nova Folsom 2012.2 and Essex 2012.1, when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. dot dot in the path attribute of a file element...

GHSA-XXGM-QPJ5-4886 OpenStack Nova Scheduler denial of service through scheduler_hints

The Nova scheduler in OpenStack Compute Nova Folsom 2012.2 and Essex 2012.1, when DifferentHostFilter or SameHostFilter is enabled, allows remote authenticated users to cause a denial of service excessive database lookup calls and server hang via a request with many repeated IDs in the...

GHSA-QRH7-X6FP-C2MP XML Entity Expansion (XEE) in Django

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute Nova Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack...

XML Entity Expansion (XEE) in Django

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute Nova Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack...

OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors

The "create an instance" API in OpenStack Compute Nova Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:ispublic property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for...

GHSA-43CM-73PX-5V4M OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors

The "create an instance" API in OpenStack Compute Nova Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:ispublic property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for...

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

The security group extension in OpenStack Compute Nova Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664...

GHSA-27Q4-38QF-M25H OpenStack Compute Nova Improper Access Control

The XenAPI backend in OpenStack Compute Nova Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups 1 when resizing an image or 2 during live migration, which allows remote attackers to bypass intended restrictions...

GHSA-M674-HMX2-FFHQ OpenStack Compute (Nova) does not verify the virtual size of a QCOW2 image

OpenStack Compute Nova Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service host file system disk consumption by creating an image with a large virtual size that does not contain a large amount of data...