CI
Product
Cinder
10
CVEs
0
On KEV
7.5
Max CVSS
1
New 30D
Severity mix
Critical 0High 2Medium 3Low 0
Watch
Add Cinder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-15139 | 7.5 | Aug 27 | A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data Affected: through 12.0.4-7 |
| CVE-2015-5162 | 7.5 | Oct 7 | The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls,… Affected: 7.0.2; 8.0.0; 8.1.0 |
| CVE-2024-32498 | 6.5 | Jul 5 | An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3 Affected: before 22.1.3; 23.0.0 before 23.1.1; 24.0.0 |
| CVE-2022-47951 | 5.7 | Jan 26 | An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x… Affected: through 19.1.2; 20.0.0 before 20.0.2 |
| CVE-2026-93856 | 4.3 | Oct 21 | In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API Affected: 9.0.0 before 26.3.1; 27.0.0; 28.0.0; 29.0.0 |
| CVE-2014-7231 | – | Oct 8 | The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when… Affected: 2013.2 before 2013.2.4; 2014.1 before 2014.1.3 |
| CVE-2014-7230 | – | Oct 8 | The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from… Affected: 2013.2 before 2013.2.4; 2014.1 before 2014.1.3 |
| CVE-2014-3641 | – | Oct 8 | The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and… Affected: through 2014.1.2; 2014.1.1 |
| CVE-2013-4202 | – | Sep 16 | The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause… Affected: 2013.1 through 2013.1.3 |
| CVE-2013-4183 | – | Sep 16 | The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users… Affected: 2013.1.1; 2013.1.2 |
Showing 10