Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 826

Export CSV
CVE-2015-0381

mysql: unspecified vulnerability related to Server:Replication (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382.

CVSS 2.0 · 4.3 Medium EPSS 5.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 17 more
CVE-2015-0374

mysql: unspecified vulnerability related to Server:Security:Privileges:Foreign Key (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key.

CVSS 2.0 · 3.5 Low EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 16 more
CVE-2015-0271

dashboard: log file arbitrary file retrieval

The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path.

CVSS 2.0 · 4.0 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Openstack
CVE-2015-0259

openstack-nova: console Cross-Site WebSocket hijacking

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

CVSS 2.0 · 5.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2014-9684

openstack-glance: potential resource exhaustion and denial of service using images manipulation API

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Openstack Redhat
Products
Image Registry And Delivery Service \(glance\) Openstack
CVE-2014-9650

RabbitMQ: /api/definitions response splitting vulnerability

CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Broadcom Redhat
Products
Rabbitmq Server Openstack
CVE-2014-9649

RabbitMQ: /api/... XSS vulnerability

Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.

CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Broadcom Redhat
Products
Rabbitmq Server Openstack
CVE-2013-6399

qemu: virtio: buffer overrun on incoming migration

Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.

CVSS 2.0 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2014-9493

openstack-glance: unrestricted path traversal flaw

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.

CVSS 2.0 · 5.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Openstack Redhat
Products
Image Registry And Delivery Service \(glance\) Openstack
CVE-2014-9130

libyaml: assert failure when processing wrapped strings

scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.

CVSS 2.0 · 5.0 Medium EPSS 13.2% KEV · Not listed
Vendors
Pyyaml Redhat
Products
Libyaml Enterprise Linux Openstack and 1 more
CVE-2014-8750

openstack-nova: Nova VMware driver may connect VNC to another tenant's console

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances.

CVSS 2.0 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2014-8578

openstack-horizon: multiple XSS flaws

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

CVSS 2.0 · 3.5 Low EPSS 1.2% KEV · Not listed
Vendors
Openstack Redhat
Products
Horizon Openstack
CVE-2014-8333

openstack-nova: Nova VMware instance in resize state may leak

The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Enterprise Linux Openstack
CVE-2014-8124

python-django-horizon: denial of service via login page requests

OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Fedoraproject Openstack Opensuse and 2 more
Products
Fedora Horizon Opensuse and 2 more
CVE-2014-8106

qemu: cirrus: insufficient blit region checks

Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2014-7960

openstack-swift: Swift metadata constraints are not correctly enforced

OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.

CVSS 2.0 · 4.0 Medium EPSS 3.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Swift Openstack Storage
CVE-2013-4542

qemu: virtio-scsi: buffer overrun on invalid state load

The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access.

CVSS 2.0 · 7.5 High EPSS 5.0% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2014-7821

openstack-neutron: DoS via maliciously crafted dns_nameservers

OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.

CVSS 2.0 · 4.0 Medium EPSS 3.9% KEV · Not listed
Vendors
Fedoraproject Openstack Redhat
Products
Fedora Neutron Openstack
CVE-2014-7231

Trove: potential leak of passwords into log files

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Cinder Nova Trove and 1 more