HO
Product
Horizon
24
CVEs
0
On KEV
6.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 8Low 0
Watch
Add Horizon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-55748 | 6.8 | Jun 17 | OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters Affected: 8.0.0 before 25.3.3; 25.4.0 before 25.5.3; 25.6.0 before 25.7.4 |
| CVE-2022-45582 | 6.1 | Aug 22 | Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter Affected: 19.4.0 through 20.1.4 |
| CVE-2020-29565 | 6.1 | Dec 4 | An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x Affected: 15.3.0 before 15.3.2; 16.0.0 before 16.2.1; 17.0.0 before 18.3.3; 18.4.0 through 18.5.0 |
| CVE-2012-5476 | 5.5 | Dec 30 | Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value Affected: 2012.2 |
| CVE-2012-5474 | 5.5 | Dec 30 | The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and… Affected: 2012.1 before 2012.1.1 |
| CVE-2016-4428 | 5.4 | Jul 12 | Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web… Affected: 8.0.0 through 8.0.1; 9.0.0; 9.0.1 |
| CVE-2026-43002 | 5.3 | May 5 | An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3 Affected: 25.6.0 before 25.7.3 |
| CVE-2017-7400 | 4.8 | Apr 3 | OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping Affected: 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +13 more |
| CVE-2015-3219 | – | Aug 20 | Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote… Affected: 2014.2.0; 2014.2.1; 2014.2.2; 2014.2.3; 2015.1.0 |
| CVE-2015-3988 | – | May 19 | Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the… Affected: 2015.1.0 |
| CVE-2014-8124 | – | Dec 12 | OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows… Affected: 2014.1 before 2014.1.3; 2014.2.0 before 2014.2.1 |
| CVE-2014-8578 | – | Oct 31 | Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote… Affected: 2013.2 before 2013.2.4; 2014.1 before 2014.1.2; juno-1; through juno-1 |
| CVE-2014-3475 | – | Oct 31 | Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows… Affected: 2013.2 before 2013.2.4; 2014.1 before 2014.1.2; juno-1 |
| CVE-2014-3474 | – | Oct 31 | Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1… Affected: 2013.2 before 2013.2.4; 2014.1 before 2014.1.2; juno-1 |
| CVE-2014-3473 | – | Oct 31 | Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before… Affected: 2013.2 before 2013.2.4; 2014.1 before 2014.1.2; juno-1 |
| CVE-2014-3594 | – | Aug 22 | Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows… Affected: 2013.2 before 2013.2.4; 2014.1 before 2014.1.2; juno-1; juno-2 |
| CVE-2013-4471 | – | May 14 | The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for… Affected: 2013.1 before 2013.2 |
| CVE-2014-0157 | – | Apr 15 | Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows… Affected: 2013.2; 2013.2.1; 2013.2.2; 2013.2.3 |
| CVE-2013-6858 | – | Nov 23 | Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance… Affected: 2013.1 through 2013.2 |
| CVE-2012-3542 | – | Sep 5 | OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a… Affected: folsom-3 |
| CVE-2012-3540 | – | Sep 5 | Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct… Affected: 2012.1 |
| CVE-2012-3426 | – | Jul 31 | OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote… Affected: folsom-1 |
| CVE-2012-2144 | – | Jun 5 | Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the sessionid cookie Affected: 2012.1; folsom-1 |
| CVE-2012-2094 | – | Jun 5 | Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1… Affected: 2012.1; folsom-1 |
Showing 24