PT-2020-14931 · Openstack +3 · Openstack Nova +3

Name of the Vulnerable Software and Affected Versions: OpenStack Nova versions prior to 19.3.1 OpenStack Nova versions 20.x prior to 20.3.1 OpenStack Nova version 21.0.0 Description: An issue was discovered in the Guest.migrate function in virt/libvirt/guest.py. By performing a soft reboot of an...

CVE-2020-17376

An information disclosure flaw was found in the live migration feature of OpenStack Nova. A user may gain access to destination host devices with the same path as those on the source host. This flaw allows an attacker to perform a soft reboot of an instance that has previously undergone live...

Nova Lite < 1.3.9 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The theme did not properly sanitise the search query, leading to an unauthenticated reflected Cross-Site Scripting issue PoC /?s=%3Cimg%20src%20onerror=alert/XSS/%3E...

WordPress Nova Lite theme <= 1.3.8 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Talip Karabas in WordPress Nova Lite theme versions = 1.3.8. Solution Update the WordPress Nova Lite theme to the latest available version at least 1.3.9...

Nova Lite < 1.3.9 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The theme did not properly sanitise the search query, leading to an unauthenticated reflected Cross-Site Scripting issue /?s=%3Cimg%20src%20onerror=alert/XSS/%3E...

CVE-2020-17362

search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS...

CVE-2020-17362

search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS...

Cross site scripting

search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS...

CVE-2020-17362

search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS...

CVE-2020-17362

Nova Lite theme for WordPress (versions before 1.3.9) is affected by a reflected XSS vulnerability in search.php. The issue arises because user-supplied search queries are not properly sanitized, allowing an attacker to inject scripts. Exploitation appears to be unauthenticated (as per multiple s...

openstack-tripleo-heat-templates: No sVirt protection for OSP16 VMs due to disabled SELinux

A flaw was found in the novalibvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines...

openstack-tripleo-heat-templates: No sVirt protection for OSP16 VMs due to disabled SELinux

A flaw was found in the novalibvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines...

CVE-2020-10731

A flaw was found in the novalibvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines...

openstack-tripleo-heat-templates: No sVirt protection for OSP16 VMs due to disabled SELinux

A flaw was found in the novalibvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines...

Security Bulletin: OpenStack vulnerabilities affect IBM SmartCloud Entry(CVE-2015-5240 CVE-2015-3280)

Summary IBM SmartCloud Entry is vulnerable to a Nova vulnerability that allows a remote authenticated attacker to cause a denial of service. IBM SmartCloud Entry is vulnerable to a Neutron vulnerability that allows an attacker to bypass firewall rules and gain access to applications. Vulnerabilit...

Security Bulletin: OpenStack vulnerabilities affect IBM SmartCloud Entry(CVE-2015-7548, CVE-2015-8749 CVE-2015-1850)

Summary IBM SmartClound Entry is vulnerable to several Openstack Nova vulerabilities, which could allow a local authenticated attacker or a remote attacker to obtain sensitive information Vulnerability Details CVEID: CVE-2015-8749 DESCRIPTION: OpenStack Nova could allow a remote attacker to obtai...

Security Bulletin: PowerVC is impacted by an Openstack Nova vulnerability which could leak consoleauth tokens into log files (CVE-2015-9543)

Summary An issue discovered in Openstack Nova can leak consoleauth tokens into log files which can be used by an attacker with access to service's log files to gain additional access in to the Openstack based deployment. Vulnerability Details CVEID: CVE-2015-9543 DESCRIPTION: OpenStack Nova could...

SUSE-SU-2020:0640-1 Security update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-ironic, openstack-keystone, openstack-monasca-agent, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, openstack-sahara, openstack-trove, python-cinderlm, python-congressclient, python-designateclient, python-ironic-lib, python-networking-cisco, python-osc-lib, python-oslo.context, python-oslo.rootwrap, python-oslo.serialization, python-oslo.service, python-stevedore, python-taskflow, rubygem-crowbar-client, rubygem-pumavenv-openstack-swift

This update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova,...

Information Disclosure

nova is vulnerable to information disclosure. The vulnerability exists as the novncproxy tokens are logged in plaintext when it is sent through the web socket proxy...

CVE-2015-9543

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is...