Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
openstack keystone vulnerabilities and exploits
(subscribe to this query)
312
VMScore
CVE-2019-19687
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other user...
Openstack Keystone 15.0.0
Openstack Keystone 16.0.0
445
VMScore
CVE-2012-1572
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
Openstack Keystone -
Debian Debian Linux 8.0
Debian Debian Linux 9.0
Debian Debian Linux 10.0
383
VMScore
CVE-2013-2255
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
Openstack Compute 2013.1
Openstack Keystone 2013
Redhat Openstack 3.0
Redhat Openstack 4.0
Debian Debian Linux 10.0
Debian Debian Linux 8.0
Debian Debian Linux 9.0
578
VMScore
CVE-2019-10138
A flaw exists in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
Python Novajoin
445
VMScore
CVE-2018-20170
OpenStack Keystone up to and including 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessaril...
Openstack Keystone
356
VMScore
CVE-2016-4911
The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x prior to 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.
Keystone Openstack Identity 9.0.0.0
534
VMScore
CVE-2015-7546
The identity service in OpenStack Identity (Keystone) prior to 2015.1.3 (Kilo) and 8.0.x prior to 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) prior to 1.5.4 (Kilo) and Liberty prior to 2.3.3 does not properly invalidate authorization tokens when using ...
Openstack Keystonemiddleware
Openstack Keystone
Oracle Solaris 11.3
356
VMScore
CVE-2015-3646
OpenStack Identity (Keystone) prior to 2014.1.5 and 2014.2.x prior to 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
Openstack Keystone
Oracle Solaris 11.2
578
VMScore
CVE-2014-0204
OpenStack Identity (Keystone) prior to 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.
Openstack Keystone
383
VMScore
CVE-2014-7144
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x prior to 0.11.0 and 1.x prior to 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote maliciou...
Openstack Keystonemiddleware 1.1.0
Openstack Python-keystoneclient
Openstack Keystonemiddleware 1.1.1
Openstack Keystonemiddleware 1.0.0
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
privilege escalation
CVE-2024-20696
CVE-2024-29829
CVE-2024-33999
CVE-2024-35646
physical
CVE-2024-24919
CVE-2024-31030
local users
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »