88 matches found
CVE-2024-31144
CVE-2024-31144 affects Xen/Xapi backup/restore of VM/SR metadata via a VDI metadata store. The vulnerability arises because the host searches VDI images to locate the metadata VDI and restore metadata; a malicious guest can manipulate its disk to appear as a metadata backup, potentially causing m...
Malicious code in xapi_test (npm)
--- -= Per source details. Do not edit below this line.=-...
PT-2024-23795
Name of the Vulnerable Software and Affected Versions Xapi affected versions not specified Description Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories SRs. The metadata itself is stored in a Virtual Disk Image VDI inside an SR. A maliciou...
Xapi: Metadata injection attack against backup/restore functionality
ISSUE DESCRIPTION For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.htmlobject-model-overview Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories SRs. The metadata itself is stored in a Virtual Disk...
CVE-2024-26140
com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 o...
Design/Logic Flaw
com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 o...
CVE-2024-26140
CVE-2024-26140 affects com.yetanalytics/lrs (core LRS library) prior to version 1.2.17 and SQL LRS prior to 0.7.5 . A maliciously crafted xAPI statement could trigger script or other tag injection in the LRS Statement Browser. The issue is patched in the listed versions; no public workarounds are...
CVE-2024-26140 com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser
com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 o...
PT-2024-21297 · Unknown +1 · Com.Yetanalytics/Lrs +1
Name of the Vulnerable Software and Affected Versions: com.yetanalytics/lrs versions prior to 1.2.17 SQL LRS versions prior to 0.7.5 Description: A maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. No known workarounds exist...
SUSE CVE-2020-29487
An issue was discovered in Xen XAPI before 2020-12-15. Certain xenstore keys provide feedback from the guest, and are therefore watched by toolstack. Specifically, keys are watched by xenopsd, and data are forwarded via RPC through message-switch to xapi. The watching logic in xenopsd sends one R...
Cisco TelePresence CE Path Traversal (cisco-sa-roomos-trav-beFvCcyu) (CSCwc21962)
According to its self-reported version, Cisco TelePresence Collaboration Endpoint Software is affected by a vulnerability in the video endpoint xAPI of Cisco TelePresence CE that could allow an authenticated, local attacker to conduct directory traversal attacks on an affected device. This...
CVE-2022-33749
XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other trusted clients, and blocks XAPI from carrying out any tasks that require the opening of file...
CVE-2022-33749
XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other trusted clients, and blocks XAPI from carrying out any tasks that require the opening of file...
CVE-2022-33749
XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other trusted clients, and blocks XAPI from carrying out any tasks that require the opening of file...
Design/Logic Flaw
XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other trusted clients, and blocks XAPI from carrying out any tasks that require the opening of file...
XAPI open file limit DoS
ISSUE DESCRIPTION It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other trusted clients, and blocks XAPI from carrying out any tasks that require the opening of file descriptors...
CVE-2022-33749
CVE-2022-33749 affects Citrix XenServer / Citrix Hypervisor (Xen) components. The issue permits an unauthenticated attacker on the management network to trigger a denial-of-service by exhausting the XAPI file-descriptor limit, preventing new requests from trusted clients and blocking tasks requir...
CVE-2022-33749
XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other trusted clients, and blocks XAPI from carrying out any tasks that require the opening of file...
PT-2022-21860 · Xapi · Xapi
Name of the Vulnerable Software and Affected Versions: XAPI affected versions not specified Description: The issue allows an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This results in XAPI being unable to accept new requests from other trusted clients an...
