CVE-2022-26779

CVE-2022-26779 (Apache CloudStack) affects CloudStack versions prior to 4.16.1.0, where project invitation tokens were generated with insecure randomness when an invite is created based on an email address. The root cause is the insecure RNG, enabling an attacker who knows the project ID and that...

CVE-2019-17562

Apache CloudStack baremetal component contains a buffer overflow (affecting all versions prior to 4.13.1) caused by inadequate validation of the mac parameter in baremetal virtual router. An attacker can inject shell commands via the mac field (example: /baremetal/provisiondone/{mac} with special...