OP
Product
Openstack
209
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 57Medium 87Low 7
Watch
Add Openstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-10384 | 6.5 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 12 |
| CVE-2017-10379 | 6.5 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: 12 |
| CVE-2017-10378 | 6.5 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 12 |
| CVE-2017-8379 | 6.5 | May 23 | Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption)… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-9921 | 6.5 | Dec 23 | Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-9911 | 6.5 | Dec 23 | Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-9907 | 6.5 | Dec 23 | Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-4020 | 6.5 | May 25 | The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2017-18635 | 6.1 | Sep 25 | An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the… Affected: 13 |
| CVE-2018-1059 | 6.1 | Apr 24 | The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host… Affected: 8; 9; 10; 11; 12 |
| CVE-2016-7103 | 6.1 | Mar 15 | Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog… Affected: 7.0; 8; 9 |
| CVE-2020-1711 | 6.0 | Feb 11 | An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while… Affected: 10; 13 |
| CVE-2016-7466 | 6.0 | Dec 10 | Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-7422 | 6.0 | Dec 10 | The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-8910 | 6.0 | Nov 4 | The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-8909 | 6.0 | Nov 4 | The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-8669 | 6.0 | Nov 4 | The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-8576 | 6.0 | Nov 4 | The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2022-3100 | 5.9 | Jan 18 | A flaw was found in the openstack-barbican component Affected: 13; 16.1; 16.2; 17 |
| CVE-2016-2124 | 5.9 | Feb 18 | A flaw was found in the way samba implemented SMB1 authentication Affected: 13; 16.1; 16.2 |
| CVE-2020-10711 | 5.9 | May 22 | A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7 Affected: 13 |
| CVE-2020-1758 | 5.9 | May 15 | A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server Affected: 10 |
| CVE-2013-2255 | 5.9 | Nov 1 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates Affected: 3.0; 4.0 |
| CVE-2018-1000808 | 5.9 | Oct 8 | Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that… Affected: 13 |
| CVE-2017-7543 | 5.9 | Jul 26 | A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2018-10855 | 5.9 | Jul 3 | Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks Affected: 13; 10; 12 |
| CVE-2018-10237 | 5.9 | Apr 26 | Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this… Affected: 13 |
| CVE-2018-2761 | 5.9 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: 12 |
| CVE-2019-14905 | 5.6 | Mar 31 | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used… Affected: 13 |
| CVE-2022-3146 | 5.5 | Mar 23 | A flaw was found in tripleo-ansible Affected: 16.1; 16.2 |
| CVE-2022-3101 | 5.5 | Mar 23 | A flaw was found in tripleo-ansible Affected: 16.1; 16.2 |
| CVE-2021-3620 | 5.5 | Mar 3 | A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error… Affected: 1; 16.1 |
| CVE-2020-10685 | 5.5 | May 11 | A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and… Affected: 10; 13; 15 |
| CVE-2012-5474 | 5.5 | Dec 30 | The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and… Affected: 2.0 |
| CVE-2016-2121 | 5.5 | Oct 31 | A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information Affected: 10 |
| CVE-2018-18438 | 5.5 | Oct 19 | Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value Affected: 8; 9; 10; 12; 13 |
| CVE-2017-2621 | 5.5 | Jul 27 | An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable Affected: 9; 10 |
| CVE-2017-2622 | 5.5 | Jul 27 | An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readable Affected: 10 |
| CVE-2017-5973 | 5.5 | Mar 27 | The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-5403 | 5.5 | Aug 2 | The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by… Affected: 5.0; 6.0; 7.0; 8; 9 |
| CVE-2019-10156 | 5.4 | Jul 30 | A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through… Affected: 13; 14 |
| CVE-2016-6519 | 5.4 | Apr 21 | Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the… Affected: 7.0; 8; 9 |
| CVE-2016-4428 | 5.4 | Jul 12 | Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web… Affected: 6.0; 7.0; 8; 5.0 |
| CVE-2015-5295 | 5.4 | Jan 20 | The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of… Affected: 7.0 |
| CVE-2018-16876 | 5.3 | Jan 3 | ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data Affected: 14 |
| CVE-2018-14432 | 5.3 | Jul 31 | In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access… Affected: 10; 12; 13 |
| CVE-2018-10892 | 5.3 | Jul 6 | The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames Affected: 12 |
| CVE-2018-7536 | 5.3 | Mar 9 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19 Affected: 10; 13 |
| CVE-2017-3636 | 5.3 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: 12 |
| CVE-2020-14364 | 5.0 | Aug 31 | An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0 Affected: 10; 13 |