CVE-2017-15113

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

PT-2018-5770

Name of the Vulnerable Software and Affected Versions: ovirt-engine versions prior to 4.1.7.6 Description: The issue allows passwords to be included in log files without masking when the log level is set to DEBUG. This poses a risk when debug-level logs are shared with external parties for...

CVE-2017-15113: Improper Removal of Sensitive Information Before Storage or Transfer

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

Red Hat oVirt ovirt-engine Information Disclosure Vulnerability

Red Hat oVirt is an open source virtualization management platform from Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side. oVirt-engine is one of the management engines. An information disclosur...

ovirt-engine-setup: unfiltered db password in engine-backup log

A flaw was found in ovirt-engine. When engine-backup was run with one of the options "--provisiondb", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords...

ovirt-engine: Unfiltered password when choosing manual db provisioning

A flaw was found in ovirt-engine. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords...

Information disclosure

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provisiondb", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database...

CVE-2018-1072

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provisiondb", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database...

CVE-2018-1072

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provisiondb", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database...

CVE-2018-1072

CVE-2018-1072 affects ovirt-engine prior to 4.2.2, where engine-backup logging could expose database credentials. The root cause is unfiltered passwords being written to provisioning logs when using --provision*db, leading to potential disclosure of usernames and passwords via shared logs. Public...

CVE-2018-1072

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provisiondb", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database...

CVE-2018-1072

A flaw was found in ovirt-engine. When engine-backup was run with one of the options "--provisiondb", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords...

CVE-2018-1072: Insertion of Sensitive Information into Log File

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provisiondb", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database...

PT-2018-10065

Name of the Vulnerable Software and Affected Versions ovirt-engine versions prior to 4.2.2 Description The issue allows for information exposure through log files. When the engine-backup command is run with certain options, such as --provisiondb, the database username and password are logged in...

CVE-2018-1073

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...

CVE-2018-1073

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...

CVE-2018-1073

CVE-2018-1073 affects the oVirt-engine web console login form, where versions before 4.2.3 reveal different errors for non-existent users vs. invalid passwords, enabling attacker user enumeration. The issue is documented in Red Hat RHSA-2018:1525 and related advisories, with remediation via the a...

CVE-2018-1073

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...

CVE-2018-1073: Generation of Error Message Containing Sensitive Information

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...

PT-2018-10069

Name of the Vulnerable Software and Affected Versions oVirt Engine versions prior to 4.2.3 Description The web console login form in oVirt Engine returned different errors for non-existent users and invalid passwords. This allowed an attacker to discover the names of valid user accounts by...