Vulnerabilities

Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor.

Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for the…

Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned.

The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.

The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.

The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0.