EV
Product
Enterprise Virtualization
36
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 3Medium 6Low 1
Watch
Add Enterprise Virtualization to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1117 | 9.8 | Jun 20 | ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently… Affected: 4.1 |
| CVE-2013-1591 | 9.8 | Jan 31 | Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4 and possibly other products, has unspecified impact and context-dependent attack vectors Affected: 3.0 |
| CVE-2015-5201 | 7.5 | Feb 25 | VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise… Affected: before 3.5.6 |
| CVE-2018-1111 | 7.5 | May 17 | DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP… Affected: 4.0; 4.2 |
| CVE-2018-1074 | 7.2 | Apr 26 | ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to… Affected: 4.0 |
| CVE-2016-6338 | 6.8 | Apr 20 | ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin… Affected: 4.0 |
| CVE-2017-2614 | 6.3 | Jul 27 | When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired Affected: 4.0 |
| CVE-2014-8167 | 5.9 | Nov 13 | vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack Affected: 3.0 |
| CVE-2013-4280 | 5.5 | Nov 4 | Insecure temporary file vulnerability in RedHat vsdm 4.9.6 Affected: 3.0 |
| CVE-2016-6310 | 5.5 | Aug 22 | oVirt Engine discloses the ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0 Affected: through 3.6 |
| CVE-2016-4443 | 5.5 | Dec 14 | Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the engine-setup log… Affected: 3.6 |
| CVE-2016-5432 | 3.3 | Oct 3 | The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log… Affected: 4.0 |
| CVE-2015-1841 | – | Sep 8 | The Web Admin interface in Red Hat Enterprise Virtualization Manager (RHEV-M) allows local users to bypass the timeout function by selecting a VM in the VM grid view Affected: 3.0 |
| CVE-2015-3456 | – | May 13 | The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or… Affected: 3.0 |
| CVE-2014-3561 | – | Dec 5 | The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport, which allows local users… Affected: 3.4 |
| CVE-2014-3559 | – | Aug 6 | The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's… Affected: 3.4 |
| CVE-2014-5177 | – | Aug 3 | libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML… Affected: 3.0 |
| CVE-2014-0179 | – | Aug 3 | libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity… Affected: 3.0 |
| CVE-2014-3485 | – | Jul 11 | The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other… Affected: 3.4 |
| CVE-2012-3406 | – | Feb 10 | The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function… Affected: 3.0 |
| CVE-2012-3405 | – | Feb 10 | The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows… Affected: 3.0 |
| CVE-2012-3404 | – | Feb 10 | The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows… Affected: 3.0 |
| CVE-2013-2152 | – | Jan 21 | Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization (RHEV) 3.2, allows local users to gain privileges via a crafted… Affected: 3.2 |
| CVE-2013-2151 | – | Jan 21 | Unquoted Windows search path vulnerability in Red Hat Enterprise Virtualization (RHEV) 3 and 3.2 allows local users to gain privileges via a crafted application in an unspecified… Affected: 3.0; 3.2 |
| CVE-2013-4282 | – | Nov 2 | Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in… Affected: 3.0 |
| CVE-2013-4181 | – | Sep 16 | Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M), as used in… Affected: 3.0; 3.2 |
| CVE-2013-2176 | – | Aug 28 | Unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool (RHEV-APT) in the rhev-guest-tools-iso package 3.2 allows local… Affected: 3.0; 3.2 |
| CVE-2013-4236 | – | Aug 19 | VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via invalid XML characters in a… Affected: 3.0; 3.2 |
| CVE-2013-0167 | – | Aug 19 | VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via guestInfo dictionaries with… Affected: 3.0; 3.2 |
| CVE-2010-2811 | – | Aug 24 | Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization (RHEV) 2.2 does not properly accept TCP connections for SSL sessions, which allows remote attackers to… Affected: 2.2 |
| CVE-2010-2784 | – | Aug 24 | The subpage MMIO initialization functionality in the subpage_register function in exec.c in QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise… Affected: 2.2 |
| CVE-2010-0435 | – | Aug 24 | The Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2, and KVM 83, when the Intel VT-x extension is enabled, allows guest OS users to cause a denial… Affected: 2.2 |
| CVE-2010-0431 | – | Aug 24 | QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83, does not properly validate guest QXL driver pointers, which… Affected: 2.2 |
| CVE-2010-0429 | – | Aug 24 | libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly restrict the addresses… Affected: 2.2 |
| CVE-2010-0428 | – | Aug 24 | libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly validate guest QXL driver… Affected: 2.2 |
| CVE-2008-3522 | – | Oct 2 | Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors… Affected: 3.5 |
Showing 36