Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 826

Export CSV
CVE-2013-6437

openstack-nova: DoS through ephemeral disk backing files

The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings, which triggers the creation of a new ephemeral disk backing file.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2015-3241

openstack-nova: Nova instance migration process does not stop when instance is deleted

OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, network, and other resource consumption) by resizing and then deleting an instance.

CVSS 2.0 · 6.8 Medium EPSS 3.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2015-2573

mysql: unspecified vulnerability related to Server:DDL (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

CVSS 2.0 · 4.0 Medium EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 14 more
CVE-2015-3281

haproxy: information leak in buffer_slow_realign()

The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Haproxy and 3 more
Products
Ubuntu Linux Debian Linux Haproxy and 11 more
CVE-2015-2568

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 15 more
CVE-2015-3988

python-django-horizon: persistent XSS in Horizon metadata dashboard

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.

CVSS 2.0 · 3.5 Low EPSS 1.8% KEV · Not listed
Vendors
Openstack Oracle Redhat
Products
Horizon Solaris Openstack
CVE-2013-6433

openstack-quantum/openstack-neutron: rootwrap sudo config allows potential privilege escalation

The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows remote attackers to gain privileges via a crafted configuration file.

CVSS 2.0 · 7.6 High EPSS 3.3% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Neutron Openstack
CVE-2015-1881

openstack-glance: potential resource exhaustion and denial of service using images manipulation API

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.

CVSS 2.0 · 4.0 Medium EPSS 2.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Image Registry And Delivery Service \(glance\) Openstack
CVE-2015-1856

Swift: unauthorized deletion of versioned Swift object

OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.

CVSS 2.0 · 5.5 Medium EPSS 4.1% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Swift Enterprise Linux and 2 more
CVE-2015-5162

openstack-nova/glance/cinder: Malicious image may exhaust resources

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.

CVSS 3.0 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Cinder Glance Nova and 1 more
CVE-2015-1852

keystonemiddleware/keystoneclient: S3Token TLS cert verification option not honored

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystonemiddleware Python-keystoneclient and 1 more
CVE-2015-1851

openstack-cinder: Host file disclosure through qcow2 backing file

OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.

CVSS 2.0 · 6.8 Medium EPSS 2.6% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Icehouse Juno and 2 more
CVE-2015-5223

openstack-swift: Information leak via Swift tempurls

OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Openstack Redhat
Products
Swift Openstack Storage
CVE-2015-1842

openstack-puppet-modules: pacemaker configured with default password

The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.2% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack-installer
CVE-2015-0441

mysql: unspecified vulnerability related to Server:Security:Encryption (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Encryption.

CVSS 2.0 · 4.0 Medium EPSS 4.5% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 13 more
CVE-2015-0433

mysql: unspecified vulnerability related to Server:InnoDB:DML (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to InnoDB : DML.

CVSS 2.0 · 4.0 Medium EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 15 more
CVE-2015-0432

mysql: unspecified vulnerability related to Server:InnoDB:DDL:Foreign Key (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key.

CVSS 2.0 · 4.0 Medium EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more
CVE-2015-0411

mysql: unspecified vulnerability related to Server:Security:Encryption (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption.

CVSS 2.0 · 7.5 High EPSS 9.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2015-0382

mysql: unspecified vulnerability related to Server:Replication (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381.

CVSS 2.0 · 4.3 Medium EPSS 10.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 17 more
CVE-2015-5963

python-django: Denial-of-service possibility in logout() view by filling session store

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.

CVSS 2.0 · 5.0 Medium EPSS 5.2% KEV · Not listed
Vendors
Canonical Djangoproject Oracle and 1 more
Products
Ubuntu Linux Django Solaris and 1 more