CVE-2012-3426

OpenStack Keystone before version 2012.1.1 (as used in Folsom before Folsom-1 and Essex) does not properly enforce token expiration, allowing remote authenticated users to bypass authorization by: (1) chaining tokens to create new ones, (2) using a token from a disabled account, or (3) using a to...

CVE-2012-2094

CVE-2012-2094 is an OpenStack Horizon XSS vulnerability in the refresh mechanism of the log viewer (horizon/static/horizon/js/horizon.js) affecting folsom-1 and 2012.1 and earlier. The underlying issue allows remote attackers to inject arbitrary script or HTML via the guest console. Documents pro...

CVE-2012-2144

CVE-2012-2144 : Session fixation in OpenStack Horizon (folsom-1 and 2012.1) allows remote attackers to hijack web sessions via the sessionid cookie. Vulnerable component: Horizon UI. Impact: session hijacking via cookie manipulation. Root cause: session fixation through sessionid handling as desc...