Ovirt - vulnerabilities (CVEs)

36 CVEs in 12 products, 0 in the last 30 days, newest from 2024-09-26.

Products

Ovirt - 12 CVEs
Ovirt-engine - 9 CVEs
Vdsm - 4 CVEs
Node - 2 CVEs
Cockpit-ovirt - 1 CVEs
Log Collector - 1 CVEs
Mom - 1 CVEs
Ovirt-ansible-roles - 1 CVEs
Ovirt-engine-cli - 1 CVEs
Ovirt-hosted-engine-setup - 1 CVEs
Ovirt-node - 1 CVEs
Sanlock - 1 CVEs

Newest CVEs of Ovirt

CVE-2024-7259 - CVSS 4.9 (medium), 2024-09-26: A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools…
CVE-2024-0822 - CVSS 7.5 (high), 2024-01-25: An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in…
CVE-2022-3193 - CVSS 6.1 (medium), 2022-09-28: An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description" fails to sanitize the…
CVE-2022-2806 - CVSS 5.5 (medium), 2022-09-01: It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev
CVE-2022-0207 - CVSS 4.7 (medium), 2022-08-26: A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear text.
CVE-2022-0435 - CVSS 8.8 (high), 2022-03-25: A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of…
CVE-2022-0847 - CVSS 7.8 (high), 2022-03-10: A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe…
CVE-2020-35497 - CVSS 6.5 (medium), 2020-12-21: A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public…
CVE-2020-14333 - CVSS 6.3 (medium), 2020-08-18: A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, resulting in a…
CVE-2019-19336 - CVSS 6.1 (medium), 2020-03-19: A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the…
CVE-2013-0293 - CVSS 7.8 (high), 2019-12-10: oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation
CVE-2012-4480 - CVSS 7.8 (high), 2019-12-02: mom creates world-writable pid files in /var/run
CVE-2012-5518 - CVSS 7.5 (high), 2019-11-25: vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate)
CVE-2015-1780 - CVSS 6.5 (medium), 2019-11-22: oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center
CVE-2013-4367 - CVSS 7.8 (high), 2019-11-01: ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's…
CVE-2019-10194 - CVSS 5.9 (medium), 2019-07-11: Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be…
CVE-2019-10139 - CVSS 7.8 (high), 2019-05-17: During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var`…
CVE-2019-3879 - CVSS 8.1 (high), 2019-03-25: It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission…
CVE-2019-3831 - CVSS 6.7 (medium), 2019-03-25: A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could…
CVE-2018-10908 - CVSS 6.5 (medium), 2018-08-09: It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an…
CVE-2017-15113 - CVSS 7.2 (high), 2018-07-27: ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log…
CVE-2018-1072 - CVSS 9.8 (critical), 2018-06-26: ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options…
CVE-2018-1117 - CVSS 9.8 (critical), 2018-06-20: ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms'…
CVE-2018-1073 - CVSS 5.3 (medium), 2018-06-19: The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker…
CVE-2018-1075 - CVSS 7.8 (high), 2018-06-12: ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to…
CVE-2018-1074 - CVSS 7.7 (high), 2018-04-26: ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including…
CVE-2018-1062 - CVSS 5.3 (medium), 2018-03-06: A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt,…
CVE-2018-1000018 - CVSS 7.8 (high), 2018-01-24: An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file.
CVE-2014-7851 - CVSS 7.5 (high), 2017-10-16: oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of…
CVE-2014-8170 - CVSS 8.8 (high), 2017-09-26: ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise…