768 matches found
OpenStack Glance Signature Verification Bypass
The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision...
GHSA-6RRM-XXVH-7R87 OpenStack Glance arbitrary deletion of non-protected images
The v1 API in OpenStack Glance Grizzly, Folsom 2012.2, and Essex 2012.1 allows remote authenticated users to delete arbitrary non-protected images via an image deletion request, a different vulnerability than CVE-2012-5482...
OpenStack Glance arbitrary deletion of non-protected images
The v1 API in OpenStack Glance Grizzly, Folsom 2012.2, and Essex 2012.1 allows remote authenticated users to delete arbitrary non-protected images via an image deletion request, a different vulnerability than CVE-2012-5482...
OpenStack Glance arbitrary deletion of non-protected images
The v2 API in OpenStack Glance Grizzly, Folsom 2012.2, and Essex 2012.1 allows remote authenticated users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573...
GHSA-VWR9-9F8V-VP5M OpenStack Glance arbitrary deletion of non-protected images
The v2 API in OpenStack Glance Grizzly, Folsom 2012.2, and Essex 2012.1 allows remote authenticated users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573...
GHSA-C8W9-83VG-R8VV OpenStack Glance is vulnerable to Exposure of Sensitive Information
The v1 API in OpenStack Glance Essex 2012.1, Folsom 2012.2, and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image...
OpenStack Glance is vulnerable to Exposure of Sensitive Information
The v1 API in OpenStack Glance Essex 2012.1, Folsom 2012.2, and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image...
GHSA-G2J5-7VGX-6XRX OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service memory and disk consumption via a crafted disk image. This iss...
OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service memory and disk consumption via a crafted disk image. This iss...
python-glanceclient vulnerable to SSL server spoofing due to unverified X.509 certificate
The Python client library for Glance python-glanceclient before 0.10.0 does not properly check the preverifyok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate and allows...
GHSA-QGFG-GVFF-523V python-glanceclient vulnerable to SSL server spoofing due to unverified X.509 certificate
The Python client library for Glance python-glanceclient before 0.10.0 does not properly check the preverifyok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate and allows...
OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme
The V2 API in OpenStack Image Registry and Delivery Service Glance before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property. NOTE: this vulnerability exists because of...
GHSA-PWRJ-F53C-F89J OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme
The V2 API in OpenStack Image Registry and Delivery Service Glance before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property. NOTE: this vulnerability exists because of...
OpenStack Glance logs user name and password in cleartext
store/swift.py in OpenStack Glance Essex 2012.1, Folsom 2012.2 before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive...
GHSA-XV7J-2V4W-CJVH OpenStack Glance logs user name and password in cleartext
store/swift.py in OpenStack Glance Essex 2012.1, Folsom 2012.2 before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive...
CVE-2022-24696
Mirametrix Glance before 5.1.1.42207 released on 2018-08-30 allows a local attacker to elevate privileges. NOTE: this is unrelated to products from the glance.com and glance.net websites...
CVE-2022-24696
Mirametrix Glance before 5.1.1.42207 released on 2018-08-30 allows a local attacker to elevate privileges. NOTE: this is unrelated to products from the glance.com and glance.net websites...
CVE-2022-24696
Mirametrix Glance before 5.1.1.42207 released on 2018-08-30 allows a local attacker to elevate privileges. NOTE: this is unrelated to products from the glance.com and glance.net websites...
Design/Logic Flaw
Mirametrix Glance before 5.1.1.42207 released on 2018-08-30 allows a local attacker to elevate privileges. NOTE: this is unrelated to products from the glance.com and glance.net websites...
