TI-2018-00992 CVE-2018-1072 · GHSA-9fw7-mcq9-ghf3
Sensitive information in log files in [UNKNOWN] ovirt-engine-setup
Priority MEDIUM 44
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files.
oVirt
Records36All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high15CVSS 7.0–8.9
Exploited now
oVirt records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
12 records in Ovirt · all components
TI-2019-02889 CVE-2019-3879 · GHSA-9fjf-3vjh-p57c
Missing authorization in ovirt-engine
Priority LOW 39
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped…
TI-2018-00994 CVE-2018-1074 · GHSA-qmxf-r2wh-hqpc
Information disclosure in ovirt-engine
Priority LOW 37
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators.
TI-2014-06524 CVE-2014-7851 · GHSA-353g-73mj-6wf9
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the…
Priority LOW 35
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by re…
TI-2018-00995 CVE-2018-1075 · GHSA-2874-9wc2-224f
Sensitive information in log files in [UNKNOWN] ovirt-engine
Priority LOW 34
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning.
Priority LOW 34
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking.
TI-2014-00146 CVE-2014-0152 · GHSA-73j8-g9r9-3463
Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier…
Priority LOW 34
Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
TI-2014-00148 CVE-2014-0154 · GHSA-3mxr-r8gm-qxvv
oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for…
Priority LOW 26
oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this co…
TI-2019-07515 CVE-2019-10194 · GHSA-2rxg-f4r2-fm3c
Sensitive information in log files in Red Hat ovirt-engine-metrics
Priority LOW 25
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions.
TI-2016-05429 CVE-2016-6341 · GHSA-vcfm-vxjm-7w5h
oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in…
Priority LOW 25
oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files.
TI-2012-03061 CVE-2012-3533 · GHSA-9rch-5m7j-5mjm
The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the…
Priority LOW 25
The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.
TI-2014-00147 CVE-2014-0153 · GHSA-mpx4-8rp2-j882
The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which…
Priority LOW 23
The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page.