OV
Product
Ovirt
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 4Medium 3Low 0
Watch
Add Ovirt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1072 | 9.8 | Jun 26 | ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files Affected: before 4.2.2 |
| CVE-2019-3879 | 8.1 | Mar 25 | It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be… Affected: before 4.3.2.1 |
| CVE-2018-1075 | 7.8 | Jun 12 | ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning Affected: before 4.2.3 |
| CVE-2014-7851 | 7.5 | Oct 16 | oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session… Affected: 3.3.2; 3.4.0 |
| CVE-2018-1074 | 7.2 | Apr 26 | ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to… Affected: through 4.1.11.1 |
| CVE-2017-15113 | 6.6 | Jul 27 | ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking Affected: before 4.1.7.6 |
| CVE-2019-10194 | 5.5 | Jul 11 | Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions Affected: All versions, or not specified |
| CVE-2016-6341 | 5.5 | Apr 20 | oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading… Affected: through 4.0.2 |
| CVE-2014-0154 | – | Feb 13 | oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive… Affected: through 3.4.4 |
| CVE-2014-0153 | – | Sep 8 | The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page Affected: through 3.4.0 |
| CVE-2014-0152 | – | Sep 8 | Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors Affected: through 3.4.0 |
| CVE-2012-3533 | – | Aug 31 | The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a… Affected: 3.1 |
Showing 12