Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 340

Export CSV
CVE-2014-9684

openstack-glance: potential resource exhaustion and denial of service using images manipulation API

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Openstack Redhat
Products
Image Registry And Delivery Service \(glance\) Openstack
CVE-2015-0259

openstack-nova: console Cross-Site WebSocket hijacking

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

CVSS 2.0 · 5.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2015-1195

openstack-glance: unrestricted path traversal flaw (incomplete fix for CVE-2014-9493) (OSSA 2015-002)

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.

CVSS 2.0 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Openstack
Products
Image Registry And Delivery Service \(glance\)
CVE-2015-1851

openstack-cinder: Host file disclosure through qcow2 backing file

OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.

CVSS 2.0 · 6.8 Medium EPSS 2.6% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Icehouse Juno and 2 more
CVE-2015-1852

keystonemiddleware/keystoneclient: S3Token TLS cert verification option not honored

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystonemiddleware Python-keystoneclient and 1 more
CVE-2015-1856

Swift: unauthorized deletion of versioned Swift object

OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.

CVSS 2.0 · 5.5 Medium EPSS 4.1% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Swift Enterprise Linux and 2 more
CVE-2015-1881

openstack-glance: potential resource exhaustion and denial of service using images manipulation API

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.

CVSS 2.0 · 4.0 Medium EPSS 2.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Image Registry And Delivery Service \(glance\) Openstack
CVE-2015-3219

python-django-horizon: XSS in Heat stack creation

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

CVSS 2.0 · 4.3 Medium EPSS 3.2% KEV · Not listed
Vendors
Debian Openstack Oracle and 1 more
Products
Debian Linux Horizon Solaris and 1 more
CVE-2015-3221

openstack-neutron: L2 agent DoS through incorrect allowed address pairs

OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.

CVSS 2.0 · 4.0 Medium EPSS 11.4% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack
CVE-2015-3241

openstack-nova: Nova instance migration process does not stop when instance is deleted

OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, network, and other resource consumption) by resizing and then deleting an instance.

CVSS 2.0 · 6.8 Medium EPSS 3.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2015-3280

openstack-nova: Deleting instances in resize state fails

OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.

CVSS 2.0 · 6.8 Medium EPSS 3.4% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2015-3289

openstack-glance: potential resource exhaustion task flow API

OpenStack Glance before 2015.1.1 (kilo) allows remote authenticated users to cause a denial of service (disk consumption) by repeatedly using the import task flow API to create images and then deleting them.

CVSS 2.0 · 4.0 Medium EPSS 1.3% KEV · Not listed
Vendors
Openstack
Products
Glance
CVE-2015-3646

openstack-keystone: cache backend password leak in log (OSSA 2015-008)

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

CVSS 2.0 · 4.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Openstack Oracle
Products
Keystone Solaris
CVE-2015-3988

python-django-horizon: persistent XSS in Horizon metadata dashboard

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.

CVSS 2.0 · 3.5 Low EPSS 1.8% KEV · Not listed
Vendors
Openstack Oracle Redhat
Products
Horizon Solaris Openstack
CVE-2015-5162

openstack-nova/glance/cinder: Malicious image may exhaust resources

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.

CVSS 3.0 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Cinder Glance Nova and 1 more
CVE-2015-5163

openstack-glance: Glance v2 API host file disclosure through qcow2 backing file

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

CVSS 2.0 · 3.5 Low EPSS 1.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Glance Openstack
CVE-2015-5223

openstack-swift: Information leak via Swift tempurls

OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Openstack Redhat
Products
Swift Openstack Storage
CVE-2015-5240

openstack-neutron: Firewall rules bypass through port update

Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack
CVE-2015-5251

openstack-glance allows illegal modification of image status

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

CVSS 2.0 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Image Registry And Delivery Service \(glance\) Openstack