Skip to content

Ovirt vulnerabilities

Products

Newest

ovirt ovirt-engine, red hat virtualization 4 +1 more Ovirt-engine: potential exposure of cleartext provider passwords via web ui CVE-2024-7259 4.9 MediumSeptember 26, 2024
ovirt ovirt-engine, red hat virtualization engine 4.4 +1 more Ovirt: authentication bypass CVE-2024-0822 Fix available 7.5 HighJanuary 25, 2024
ovirt ovirt-engine An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt... CVE-2022-3193 6.1 MediumSeptember 28, 2022
sos project sos, ovirt log collector +1 more sosreport Exposure of Sensitive Information vulnerability CVE-2022-2806 Fix available 5.5 MediumSeptember 1, 2022
[unknown] vdsm, redhat virtualization, virtualization for ibm power little endian +1 more +3 more A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that... CVE-2022-0207 Fix available 4.7 MediumAugust 26, 2022
linux kernel, fedoraproject fedora, netapp h300e firmware +26 more +28 more Important: kernel security, bug fix, and enhancement update CVE-2022-0847 In KEVPublic exploitFix available EPSS 92.8% 7.8 HighMarch 7, 2022
linux kernel, ovirt node, fedoraproject fedora +27 more +29 more Important: kernel security, bug fix, and enhancement update CVE-2022-0435 Public exploitFix available EPSS 67.8% 8.8 HighFebruary 10, 2022
ovirt ovirt-engine, redhat virtualization +1 more A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other... CVE-2020-35497 Fix available 6.5 MediumDecember 21, 2020
ovirt ovirt-engine A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not... CVE-2020-14333 6.3 MediumAugust 18, 2020
ovirt ovirt-engine, redhat virtualization +1 more A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization... CVE-2019-19336 Fix available 5.4 MediumMarch 19, 2020
ovirt node oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation CVE-2013-0293 7.8 HighDecember 10, 2019
mom, fedoraproject fedora +1 more mom creates world-writable pid files in /var/run CVE-2012-4480 7.8 HighDecember 2, 2019
[unknown] vdsm vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from... CVE-2012-5518 7.5 HighNovember 25, 2019
ovirt, redhat ovirt-engine, virtualization +2 more oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data... CVE-2015-1780 6.5 MediumNovember 22, 2019
ovirt ovirt-engine ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due... CVE-2013-4367 7.8 HighNovember 1, 2019
ovirt, red hat ovirt-engine-metrics, redhat virtualization manager +2 more Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were... CVE-2019-10194 Fix available 5.9 MediumJuly 11, 2019
ovirt cockpit-ovirt During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var... CVE-2019-10139 Fix available 5.6 MediumMay 17, 2019
ovirt, redhat virtualization, unspecified ovirt-engine +2 more It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is... CVE-2019-3879 Fix available 6.5 MediumMarch 25, 2019
[unknown] vdsm, redhat gluster storage +1 more A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8.... CVE-2019-3831 Fix available 6.4 MediumMarch 25, 2019
[unknown] vdsm, redhat virtualization +1 more It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without... CVE-2018-10908 Fix available 6.5 MediumAugust 9, 2018
ovirt, red hat ovirt-engine, redhat virtualization +2 more ovirt-engine Logs Plaintext Passwords To File CVE-2017-15113 Fix available 7.2 HighJuly 27, 2018
ovirt, [unknown] ovirt-engine-setup, redhat enterprise virtualization manager +2 more ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log... CVE-2018-1072 5.0 MediumJune 26, 2018
[unknown] ovirt-ansible-roles, redhat enterprise virtualization +1 more ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive,... CVE-2018-1117 Fix available 5.0 MediumJune 19, 2018
[unknown] ovirt-engine, redhat virtualization, virtualization host +2 more The web console login form in ovirt-engine before version 4.2.3 returned different errors for non... CVE-2018-1073 5.3 MediumJune 19, 2018
[unknown] ovirt-engine, ovirt +1 more ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db... CVE-2018-1075 5.0 MediumJune 12, 2018
ovirt, unspecified ovirt-engine, redhat enterprise virtualization +2 more ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to... CVE-2018-1074 Fix available 7.7 HighApril 26, 2018
ovirt, redhat ovirt-engine +1 more A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable... CVE-2018-1062 Fix available 5.3 MediumMarch 6, 2018
ovirt ovirt-hosted-engine-setup An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's... CVE-2018-1000018 7.8 HighJanuary 24, 2018
ovirt, redhat ovirt-engine +1 more oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin,... CVE-2014-7851 Fix available 7.5 HighOctober 16, 2017
ovirt ovirt-node ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0... CVE-2014-8170 8.8 HighSeptember 25, 2017
ovirt oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log... CVE-2016-6341 5.5 MediumApril 20, 2017
ovirt oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the... CVE-2014-0154 5.0 MediumFebruary 13, 2015
ovirt The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows... CVE-2014-0153 4.3 MediumSeptember 8, 2014
ovirt, redhat ovirt-engine +1 more Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows... CVE-2014-0152 6.8 MediumSeptember 8, 2014
ovirt sanlock The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log... CVE-2012-5638 Fix available 3.6 LowDecember 20, 2012
ovirt, ovirt ovirt-engine-cli, ovirt-engine-sdk 3.1.0.5 +2 more The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL... CVE-2012-3533 5.0 MediumAugust 31, 2012