OpenStack

Records333All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical23CVSS 9.0–10.0

CVSS high77CVSS 7.0–8.9

Exploited now

OpenStack records in CISA KEV

No OpenStack vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Keystone 44 records MEDIUM Nova 39 records HIGH Folsom 25 records LOW Neutron 25 records MEDIUM Horizon 24 records MEDIUM Essex 15 records LOW Image Registry And Delivery Service (glance) 15 records LOW Swift 15 records MEDIUM

Records

24 records in Horizon · all components

TI-2026-31182 CVE-2026-43002 · GHSA-vxvf-xvm3-p8j5

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3.

MEDIUM 63

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0036 Published 2026-05-05 Fixed in 25.7.3 CWE-696

TI-2012-01917 CVE-2012-2144 · GHSA-w7h9-8wr4-hwqh

Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1…

LOW 34

Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the sessionid cookie.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02086 Published 2012-06-05 Fixed in 8.0.0a0 CWE-384

TI-2026-40246 CVE-2026-55748 · GHSA-6wrm-x65g-hr4p

OS command injection in OpenStack Horizon

LOW 32

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00251 Published 2026-06-17 Partial fix · 25.3.3, 25.5.3 +1 CWE-78

TI-2012-03067 CVE-2012-3540 · GHSA-j72v-mpwp-rg79

Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex…

LOW 31

Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next param…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.02908 Published 2012-09-05 Fixed CWE-20

TI-2020-17754 CVE-2020-29565 · GHSA-f8fh-xp28-q59m

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and…

LOW 30

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01423 Published 2020-12-04 Partial fix · 15.3.2, 16.2.1 +2 CWE-601

TI-2022-22498 CVE-2022-45582 · GHSA-5pv6-rprw-82wv

Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.

LOW 29

Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00795 Published 2023-08-22 Fixed in 20.2.0 CWE-601

TI-2016-03804 CVE-2016-4428 · GHSA-grm6-x6mr-q3cv

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and…

LOW 29

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS templ…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02085 Published 2016-07-12 Fixed in 8.0.2, 9.1.0 CWE-79

TI-2014-06739 CVE-2014-8124 · GHSA-q878-vxpg-6qx6

OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not…

LOW 28

OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02944 Published 2014-12-12 Partial fix CWE-400

TI-2013-03920 CVE-2013-4471 · GHSA-3hqv-63pg-94p2

The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the…

LOW 27

The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by…

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.01204 Published 2014-05-14 No fix listed CWE-287

TI-2012-02955 CVE-2012-3426 · GHSA-xp97-6w7r-4cjc

OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and…

LOW 27

OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.02296 Published 2012-07-31 Fixed in 8.0.0a0 CWE-264

TI-2015-02848 CVE-2015-3219 · GHSA-rhjj-f6gq-6gx2

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack…

LOW 26

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or H…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03196 Published 2015-08-20 Fixed in 8.0.0a0 CWE-79

TI-2012-04595 CVE-2012-5476 · GHSA-w8fv-pp3m-2hqx

Information disclosure in openstack-dashboard

LOW 25

Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00398 Published 2019-12-30 No fix listed CWE-200

TI-2012-04594 CVE-2012-5474 · GHSA-4q46-pmqc-c3vc

The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0…

LOW 25

The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00338 Published 2019-12-30 Fixed in 2012.1.1 CWE-311

TI-2012-03068 CVE-2012-3542 · GHSA-gf2q-j2qq-pjf2

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex…

LOW 25

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02491 Published 2012-09-05 Fixed in 2012.1 CWE-264

TI-2012-01867 CVE-2012-2094 · GHSA-j772-hpmw-32rm

Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in…

LOW 25

Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inje…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02399 Published 2012-06-05 Fixed in 8.0.0a0 CWE-79

TI-2017-05054 CVE-2017-7400 · GHSA-47vp-44v9-rhgq

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote…

LOW 24

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.01063 Published 2017-04-03 Fixed in 9.1.2, 10.0.3 +1 CWE-79

TI-2013-05632 CVE-2013-6858 · GHSA-q74p-53hj-4w6q

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon)…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topol…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01734 Published 2013-11-23 Partial fix CWE-79

TI-2014-02800 CVE-2014-3473 · GHSA-8vwv-2v7v-jmgr

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the…

LOW 23

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when us…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01703 Published 2014-10-31 Partial fix · 8.0.0a0 CWE-79

TI-2014-00151 CVE-2014-0157 · GHSA-cmg8-5c63-pg95

Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in…

LOW 22

Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01216 Published 2014-04-15 Partial fix · 2013.2.4 CWE-79

TI-2014-02917 CVE-2014-3594 · GHSA-8g68-2hcj-h8vg

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack…

LOW 21

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.0207 Published 2014-08-22 Partial fix · 8.0.0a0 CWE-79

TI-2014-02801 CVE-2014-3474 · GHSA-j57p-g33w-95c5

Cross-site scripting (XSS) vulnerability in…

LOW 21

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allo…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01933 Published 2014-10-31 Partial fix · 8.0.0a0 CWE-79

TI-2015-03371 CVE-2015-3988 · GHSA-chfp-7692-g532

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon)…

LOW 20

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavo…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01787 Published 2015-05-19 Fixed CWE-79

TI-2014-07044 CVE-2014-8578 · GHSA-grxx-9m9p-rf4j

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard…

LOW 19

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.0118 Published 2014-10-31 Partial fix CWE-79

TI-2014-02802 CVE-2014-3475 · GHSA-vw9p-vx37-72h4

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack…

LOW 19

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01235 Published 2014-10-31 Partial fix CWE-79

Open these records in search →