OP
Product
Openstack
209
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 57Medium 87Low 7
Watch
Add Openstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-1759 | 6.8 | Apr 13 | A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the… Affected: 15 |
| CVE-2020-14355 | 6.6 | Oct 7 | Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1 Affected: 16.1 |
| CVE-2023-2088 | 6.5 | May 12 | A flaw was found in OpenStack due to an inconsistency between Cinder and Nova Affected: All versions, or not specified |
| CVE-2022-1655 | 6.5 | Jul 22 | An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack Affected: 16.2 |
| CVE-2021-3930 | 6.5 | Feb 18 | An off-by-one error was found in the SCSI device emulation in QEMU Affected: 10; 13 |
| CVE-2020-10756 | 6.5 | Jul 9 | An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator Affected: 13 |
| CVE-2019-14900 | 6.5 | Jul 6 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1 Affected: 10; 13; 14 |
| CVE-2020-10753 | 6.5 | Jun 26 | A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) Affected: 15 |
| CVE-2019-14856 | 6.5 | Nov 26 | ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None Affected: 13 |
| CVE-2013-6461 | 6.5 | Nov 5 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits Affected: 3.0; 4.0 |
| CVE-2013-6460 | 6.5 | Nov 5 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents Affected: 3.0; 4.0 |
| CVE-2019-14433 | 6.5 | Aug 9 | An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2 Affected: 10; 13; 14 |
| CVE-2019-10876 | 6.5 | Apr 5 | An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3 Affected: 13; 14 |
| CVE-2019-9735 | 6.5 | Mar 13 | An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3 Affected: 10; 13; 14 |
| CVE-2018-14635 | 6.5 | Sep 10 | When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation Affected: 10; 12; 13 |
| CVE-2016-9590 | 6.5 | Apr 26 | puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift) Affected: 8; 9; 10 |
| CVE-2018-2819 | 6.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 12 |
| CVE-2018-2817 | 6.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 12 |
| CVE-2018-2668 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 12 |
| CVE-2018-2665 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 12 |
| CVE-2018-2640 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 12 |
| CVE-2018-2622 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 12 |
| CVE-2017-10384 | 6.5 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 12 |
| CVE-2017-10379 | 6.5 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: 12 |
| CVE-2017-10378 | 6.5 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 12 |
| CVE-2017-8379 | 6.5 | May 23 | Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption)… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-9921 | 6.5 | Dec 23 | Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-9911 | 6.5 | Dec 23 | Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-9907 | 6.5 | Dec 23 | Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-4020 | 6.5 | May 25 | The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2017-18635 | 6.1 | Sep 25 | An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the… Affected: 13 |
| CVE-2018-1059 | 6.1 | Apr 24 | The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host… Affected: 8; 9; 10; 11; 12 |
| CVE-2016-7103 | 6.1 | Mar 15 | Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog… Affected: 7.0; 8; 9 |
| CVE-2020-1711 | 6.0 | Feb 11 | An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while… Affected: 10; 13 |
| CVE-2016-7466 | 6.0 | Dec 10 | Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-7422 | 6.0 | Dec 10 | The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-8910 | 6.0 | Nov 4 | The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-8909 | 6.0 | Nov 4 | The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-8669 | 6.0 | Nov 4 | The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-8576 | 6.0 | Nov 4 | The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2022-3100 | 5.9 | Jan 18 | A flaw was found in the openstack-barbican component Affected: 13; 16.1; 16.2; 17 |
| CVE-2016-2124 | 5.9 | Feb 18 | A flaw was found in the way samba implemented SMB1 authentication Affected: 13; 16.1; 16.2 |
| CVE-2020-10711 | 5.9 | May 22 | A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7 Affected: 13 |
| CVE-2020-1758 | 5.9 | May 15 | A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server Affected: 10 |
| CVE-2013-2255 | 5.9 | Nov 1 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates Affected: 3.0; 4.0 |
| CVE-2018-1000808 | 5.9 | Oct 8 | Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that… Affected: 13 |
| CVE-2017-7543 | 5.9 | Jul 26 | A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2018-10855 | 5.9 | Jul 3 | Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks Affected: 13; 10; 12 |
| CVE-2018-10237 | 5.9 | Apr 26 | Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this… Affected: 13 |
| CVE-2018-2761 | 5.9 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: 12 |