Cross site scripting

Cross-site scripting XSS vulnerability in the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name...

PT-2014-5410

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions prior to 2013.2.4 OpenStack Dashboard Horizon versions 2014.1 prior to 2014.1.2 OpenStack Dashboard Horizon Juno versions prior to Juno-3 Description A cross-site scripting XSS issue exists in the Host...

CVE-2014-5253

OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain...

CVE-2014-5252

The V3 API in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issuedat value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification 1 GET or 2 HEAD request to v3/auth/tokens/...