CVE-2020-10775

CVE-2020-10775 is an open redirect vulnerability in ovirt-engine up to version 4.4. It allows remote attackers to redirect users to arbitrary sites and enable phishing attacks; the malicious URL’s critical portion can become hidden, impacting confidentiality. Multiple connected sources confirm th...

CVE-2014-0151

The CVE-2014-0151 CSRF flaw affects oVirt Engine prior to 3.5.0 beta2, enabling a remote attacker to hijack a legitimate user’s session by crafting a page that triggers REST API actions. Root cause is a CSRF vulnerability in the oVirt REST API, with the trusted session reused for unintended reque...

CVE-2015-1780

CVE-2015-1780 affects oVirt (notably ovirt-engine) where users holding MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center. The connected Nessus entries corroborate an unpatched exposure for this vulnerability, but the provided documents do not include patch versi...

CVE-2014-0152

CVE-2014-0152 affects oVirt Web Admin Interface (3.4.0 and earlier). Root cause: after authentication, a new session ID is not generated and session IDs may be stored in HTML5 local storage, not protected by same-origin policy. This enables a remote attacker to hijack a logged-in user’s session v...

CVE-2018-1062

CVE-2018-1062 affects oVirt 4.1.x before 4.1.9. The vulnerability arises when both Enable Discard and Wipe After Delete are enabled for VM disks, potentially leaving data not fully zeroed after disk removal. If the same storage blocks are later allocated to a new disk attached to another VM, priv...

CVE-2014-7851

Vulnerability CVE-2014-7851 affects oVirt 3.2.2–3.5.0 where restapi sessions are not invalidated after logout from webadmin, enabling remote authenticated users who know another user’s session data to assume that user’s privileges by swapping session tokens. Root cause: restapi session not invali...

CVE-2016-3113

CVE-2016-3113 is a cross-site scripting vulnerability in the ovirt-engine web UI. The vulnerability allows remote attackers to inject arbitrary web script or HTML. Affected: ovirt-engine (web UI) component; root cause relates to input handling enabling script/HTML injection. Impact stated by NVD:...

CVE-2016-3077

CVE-2016-3077 affects oVirt Engine via the VersionMapper.fromKernelVersionString method. The vulnerability allows remote authenticated users to trigger a denial of service (process crash) affecting all VMs. No exploitation vector or exploit details are provided in the supplied documents. Remediat...

CVE-2017-7510

The CVE-2017-7510 issue affects ovirt-engine 4.1 where a host provisioned with cloud-init could have its root password exposed via the REST API. The connected sources corroborate that the REST interface exposes data used in cloud-init, including the root password, introducing high-impact risk (CV...

CVE-2018-1000095

CVE-2018-1000095 is a stored XSS in oVirt 4.2.0–4.2.2 within the web admin UI's VM name/description. Root cause: HTML sanitization was not applied consistently across fields, enabling a VM Admin to inject script/HTML that could affect other VM/Cluster administrators. The issue is fixed in version...