247 matches found
CVE-2012-0860
Concrete details found: CVE-2012-0860 affects Red Hat Enterprise Virtualization Manager (RHEV-M) up to version 3.1. The root cause is that Python configuration scripts (deployUtil.py or vds_bootstrap.py) stored in /tmp/ could be pre-created by a local unprivileged user during host addition, allow...
CVE-2011-4316
CVE-2011-4316 affects Red Hat Enterprise Virtualization Manager (RHEV-M) prior to 3.1. The vulnerability arises because the desktop screen is not locked between SPICE sessions under certain conditions, enabling a local user with VM access to view or switch to other users’ desktop sessions via uns...
PT-2013-1519 · Red Hat · Red Hat Enterprise Virtualization Manager
Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager RHEV-M versions prior to 3.1 Description: The issue concerns the use of the -k curl parameter by the vds installer when adding a host, which prevents SSL certificates from being validated. This allows...
CVE-2011-4316: Undefined Security Weakness
Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors...
CVE-2012-0860: Undefined Security Weakness
Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse 1 deployUtil.py or 2 vdsbootstrap.py Python module in /tmp/...
CVE-2012-2696: Undefined Security Weakness
The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...
CVE-2012-5516: Exposure of Sensitive Information to an Unauthorized Actor
Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors...
CVE-2012-0861: Undefined Security Weakness
The vdsinstaller in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vdsbootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via...
PT-2013-1518 · Red Hat · Red Hat Enterprise Virtualization Manager
Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager RHEV-M versions prior to 3.1 Description: The issue allows local users to gain privileges via a Trojan horse Python module, specifically deployUtil.py or vds bootstrap.py, in the /tmp/ directory when...
rhev: vds_installer is prone to MITM when downloading 2nd stage installer
The vdsinstaller in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vdsbootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via...
rhev: vds_installer insecure /tmp use
Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse 1 deployUtil.py or 2 vdsbootstrap.py Python module in /tmp/...
SPICE screen locking race condition
Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors...
rhev-m: MoveDisk ignores the disk's wipe-after-delete property
Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors...
rhev: vds_installer insecure /tmp use
Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse 1 deployUtil.py or 2 vdsbootstrap.py Python module in /tmp/...
rhev: vds_installer is prone to MITM when downloading 2nd stage installer
The vdsinstaller in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vdsbootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via...
CVE-2011-2163
Unspecified vulnerability in Virtualization Manager 1.2.2 in IBM Systems Director 1.2.2 has unknown impact and attack vectors...
Security feature bypass
Unspecified vulnerability in Virtualization Manager 1.2.2 in IBM Systems Director 1.2.2 has unknown impact and attack vectors...
CVE-2011-2163
Technical details about CVE-2011-2163 are not publicly available in the provided documents. Monitor for updates from official advisories.
