Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances

The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port global setting) for…

The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server…

By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request

Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection

A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack

Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API

Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC…

Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI

Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access

Apache CloudStack: OS Command Injection due to unsanitized mount command

Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

Apache CloudStack: Get and Run Diagnostics Command Injection

Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and…

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password…

Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests

Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks to their existing…

Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP

Apache CloudStack: MinIO policy remains intact on bucket deletion

Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to

When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used…

The CloudStack SAML authentication (disabled by default) does not enforce signature check

Apache CloudStack: DoS caused by database connections leak

Apache CloudStack: Improper access control in Userdata reference APIs

Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure

Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob

Apache CloudStack: LDAP provider configuration disclosure

Apache CloudStack: OAuth2 Token Cross-Request Leak

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens

The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects…

Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue

CloudStack account-users by default use username and password based authentication for API and UI access

The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service

Apache CloudStack: Any user can create a new VM from backups they should not have access to

Apache CloudStack: Any user can list backups that they should not have access to

Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote…

A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has privilege to deploy a VM instance or…

The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default

Apache CloudStack: Unauthorised comment creation and disclosure

Apache CloudStack: Domain/account resources limits not honored

Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified…

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins

In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs

Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

Apache CloudStack: Webhook Deliveries Incorrect Access