Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24

Export CSV
CVE-2018-1072

ovirt-engine-setup: unfiltered db password in engine-backup log

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.

CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt Enterprise Virtualization Manager Rhev Manager
CVE-2018-1000018

ovirt-hosted-engine-setup: root password exposed in log file

An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Ovirt
Products
Ovirt-hosted-engine-setup
CVE-2017-15113

ovirt-engine: DEBUG logging includes unmasked passwords

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.

CVSS 3.0 · 7.2 High EPSS 1.1% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt Rhev Manager Virtualization
CVE-2013-4367

ovirt-engine: some config files left world-writable due to improper use of os.chmod()

ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod() works when passed a mode of '-1'.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Ovirt
Products
Linux Kernel Ovirt-engine