Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 62

Export CSV
CVE-2010-2793

spice activex/spicec named pipe races

Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors involving knowledge of the name of this named pipe, in conjunction with use of the ImpersonateNamedPipeClient function.

CVSS 2.0 · 6.8 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Enterprise Virtualization Manager Rhev Manager Spice-activex
CVE-2010-2811

vdsm: SSL accept() blocks on a non-blocking Connection

Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization (RHEV) 2.2 does not properly accept TCP connections for SSL sessions, which allows remote attackers to cause a denial of service (daemon outage) via crafted SSL traffic.

CVSS 2.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Virtualization
CVE-2011-1576

kernel: net: Fix memory leak/corruption on VLAN GRO_DROP

The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478.

CVSS 2.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 2 more
CVE-2011-4316

SPICE screen locking race condition

Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors.

CVSS 2.0 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Virtualization Manager Rhev Manager
CVE-2012-0861

rhev: vds_installer is prone to MITM when downloading 2nd stage installer

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Virtualization Manager Rhev Manager
CVE-2012-2696

rhev: backend allows unprivileged queries

The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a (1) SOAP or (2) GWT request.

CVSS 2.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Virtualization Manager Rhev Manager
CVE-2012-3404

glibc: incorrect size calculation in formatted printing can lead to FORTIFY_SOURCE format string protection bypass

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Glibc Enterprise Linux and 1 more
CVE-2012-3405

glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.

CVSS 2.0 · 5.0 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Glibc Enterprise Linux and 1 more
CVE-2012-3406

glibc: printf() unbound alloca() usage in case of positional parameters + many format specs

The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.

CVSS 2.0 · 6.8 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Glibc Enterprise Linux and 1 more
CVE-2012-5516

rhev-m: MoveDisk ignores the disk's wipe-after-delete property

Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Virtualization Manager Rhev Manager
CVE-2018-8897

Kernel: error in exception handling leads to DoS

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.

CVSS 3.0 · 7.8 High EPSS 18.5% KEV · Not listed
Vendors
Apple Canonical Citrix and 5 more
Products
Mac Os X Ubuntu Linux Xenserver and 16 more
CVE-2018-1117

ovirt-ansible-roles: passwords revealed in ansible log when provisioning new provider

ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.

CVSS 3.0 · 5 Medium EPSS 1.4% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt-ansible-roles Enterprise Virtualization Rhev Manager
CVE-2018-1111

dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

CVSS 3.0 · 7.5 High EPSS 97.9% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2018-1074

ovirt-engine: API exposes power management credentials to administrators

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.

CVSS 3.0 · 7.7 High EPSS 1.4% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt Enterprise Virtualization Rhev Manager
CVE-2018-1072

ovirt-engine-setup: unfiltered db password in engine-backup log

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.

CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt Enterprise Virtualization Manager Rhev Manager
CVE-2018-14652

glusterfs: Buffer overflow in "features/locks" translator allows for denial of service

The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GF_XATTR_CLRLK_CMD' xattr in the 'pl_getxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Enterprise Linux Enterprise Linux Server and 4 more
CVE-2017-2614

rhev-m-4: Fails to validate existing expired passwords when changing a password

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts.

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Virtualization Rhev Manager
CVE-2015-5201

RHEV: vdsm spice disable-ticketing and VM suspend and restore allows auth bypass

VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows remote attackers to log in without authentication via unspecified vectors.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Virtualization Enterprise Virtualization Hypervisor