336 matches found
PT-2018-10078
Name of the Vulnerable Software and Affected Versions oVirt Engine versions prior to 4.2.2.5 oVirt Engine versions prior to 4.1.11.2 Description The issue allows exposure of Power Management credentials, including cleartext passwords, to Host Administrators. A Host Administrator could exploit thi...
ovirt-engine: API exposes power management credentials to administrators
The ovirt-engine API and administration web portal exposed Power Management credentials including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control...
ovirt-engine: When Wipe After Delete (WAD) and Enable Discard are both enabled for a VM disk, discarded data might not be wiped after the disk is removed.
It was discovered that the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially...
ovirt-engine: webadmin log out must logout all sessions
It was discovered that the ovirt-engine webadmin session would not properly enforce timeouts. Browser sessions would remain logged in beyond the administratively configured session timeout period...
Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2017-38353)
Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...
CVE-2017-15113
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...
ovirt-engine: DEBUG logging includes unmasked passwords
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...
Red Hat MRG ovirt-engine certificate validation security bypass vulnerability
Red Hat MRG is a suite of IT infrastructure platforms for integrated high-performance computing HPC from Red Hat, Inc. ovirt-engine is one of the open source virtualization management platform. A security vulnerability exists in ovirt-engine in Red Hat MRG version 3, which stems from the program'...
Code injection
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...
CVE-2014-3706
CVE-2014-3706 affects ovirt-engine (as used in Red Hat MRG 3). The vulnerability stems from failure to verify key attributes in vdsm X.509 certificates, enabling MITM attackers to spoof servers. Public details in the provided documents confirm the issue and its impact on server authentication. Mu...
CVE-2014-3706
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...
PT-2017-5883
Name of the Vulnerable Software and Affected Versions: ovirt-engine affected versions not specified Description: The issue allows man-in-the-middle attackers to spoof servers. This is due to a failure to verify key attributes in vdsm X.509 certificates. Recommendations: At the moment, there is no...
CVE-2014-3706: Improper Certificate Validation
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...
CVE-2016-6310
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
CVE-2016-6310
CVE-2016-6310 affects oVirt Engine (RHEV before 4.0). The vulnerability involves a information disclosure where ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD is exposed in /var/log/ovirt-engine/engine.log. The connected sources confirm the issue without detailing exploitation steps, affected versions bey...
CVE-2016-6310
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
CVE-2016-6310
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...
PT-2017-8958
Name of the Vulnerable Software and Affected Versions oVirt Engine versions prior to 4.0 Description The issue concerns the disclosure of sensitive information, specifically the ENGINE HTTPS PKI TRUST STORE PASSWORD, which is logged in the /var/log/ovirt-engine/engine.log file. This affects oVirt...
CVE-2016-6310: Exposure of Sensitive Information to an Unauthorized Actor
oVirt Engine discloses the ENGINEHTTPSPKITRUSTSTOREPASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0...