Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
openstack vulnerabilities and exploits
(subscribe to this query)
4
CVSSv2
CVE-2021-3654
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Openstack Nova
Redhat Openstack Platform 16.1
Redhat Openstack Platform 16.2
2.1
CVSSv2
CVE-2016-8669
The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.
Qemu Qemu
Opensuse Leap 42.2
Redhat Openstack 7.0
Redhat Openstack 6.0
Redhat Openstack 10
Redhat Openstack 9
Redhat Openstack 8
Redhat Openstack 11
Redhat Virtualization 4.0
Debian Debian Linux 8.0
2.1
CVSSv2
CVE-2016-9921
Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process inst...
Qemu Qemu
Qemu Qemu 2.8.0
Debian Debian Linux 8.0
Redhat Openstack 7.0
Redhat Openstack 6.0
Redhat Openstack 10
Redhat Openstack 9
Redhat Openstack 8
Redhat Openstack 11
Redhat Virtualization 4.0
4.4
CVSSv2
CVE-2013-0261
(1) installer/basedefs.py and (2) modules/ospluginutils.py in PackStack allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
Openstack Essex -
Openstack Folsom -
2.1
CVSSv2
CVE-2013-0266
manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.
Openstack Essex -
Openstack Folsom -
9
CVSSv2
CVE-2020-26943
An issue exists in OpenStack blazar-dashboard prior to 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may ...
Openstack Blazar-dashboard
Openstack Blazar-dashboard 2.0.0
Openstack Blazar-dashboard 3.0.0
6
CVSSv2
CVE-2016-9599
puppet-tripleo prior to 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rules with empty port values. If SSL is enabled, a malicious user could use these open ports to gain access to unauthorized resourc...
Openstack Puppet-tripleo 5.5.0
Openstack Puppet-tripleo 6.2.0
Redhat Openstack 10
4.9
CVSSv2
CVE-2020-1690
An improper authorization flaw exists in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack (RHOSP) containers could send messages to the dbus. With acces...
Redhat Openstack-selinux
Redhat Openstack Platform 16.1
Redhat Openstack Platform 15.0
4.9
CVSSv2
CVE-2014-5251
The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x prior to 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expi...
Openstack Keystone Juno-2
Openstack Keystone 2014.1
Canonical Ubuntu Linux 14.04
Openstack Keystone Juno-1
Openstack Keystone 2014.1.2
4.9
CVSSv2
CVE-2014-5252
The V3 API in OpenStack Identity (Keystone) 2014.1.x prior to 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request ...
Openstack Keystone 2014.1.2
Openstack Keystone Juno-2
Openstack Keystone 2014.1
Canonical Ubuntu Linux 14.04
Openstack Keystone Juno-1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
camera
bypass
CVE-2024-3592
CVE-2024-37383
CVE-2024-24919
CVE-2024-27822
CVE-2024-36788
CVE-2024-36789
man-in-the-middle
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
10
NEXT »