OP
Product
Openstack
209
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 57Medium 87Low 7
Watch
Add Openstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-1733 | 5.0 | Mar 11 | A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user Affected: 13 |
| CVE-2018-17206 | 4.9 | Sep 19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6 Affected: 10; 13 |
| CVE-2018-2781 | 4.9 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 12 |
| CVE-2017-3641 | 4.9 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML) Affected: 12 |
| CVE-2019-11291 | 4.8 | Nov 22 | Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain… Affected: 15 |
| CVE-2019-11281 | 4.8 | Oct 16 | Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain… Affected: 15 |
| CVE-2020-1740 | 4.7 | Mar 16 | A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files Affected: 13 |
| CVE-2020-1735 | 4.6 | Mar 16 | A flaw was found in the Ansible Engine when the fetch module is used Affected: 13 |
| CVE-2018-2771 | 4.4 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Locking) Affected: 12 |
| CVE-2016-6888 | 4.4 | Dec 10 | Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2021-4180 | 4.3 | Mar 23 | An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname Affected: 13; 16.1; 16.2 |
| CVE-2018-17204 | 4.3 | Sep 19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c Affected: 10; 13 |
| CVE-2018-2813 | 4.3 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 12 |
| CVE-2017-3651 | 4.3 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump) Affected: 12 |
| CVE-2017-10268 | 4.1 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication) Affected: 12 |
| CVE-2020-1738 | 3.9 | Mar 16 | A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified Affected: 13 |
| CVE-2020-1739 | 3.9 | Mar 12 | A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command… Affected: 13 |
| CVE-2015-6815 | 3.5 | Jan 31 | The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to… Affected: 5.0; 6.0; 7.0 |
| CVE-2020-1736 | 3.3 | Mar 16 | A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified Affected: 13 |
| CVE-2018-2767 | 3.1 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption) Affected: 12 |
| CVE-2017-3653 | 3.1 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 12 |
| CVE-2022-4134 | 2.8 | Mar 6 | A flaw was found in openstack-glance Affected: 13; 16.1; 16.2; 17 |
| CVE-2015-5225 | – | Nov 6 | Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption… Affected: 5.0; 6.0; 7.0 |
| CVE-2015-3214 | – | Aug 31 | The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS… Affected: 5.0; 6.0 |
| CVE-2015-5165 | – | Aug 12 | The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via… Affected: 5.0; 6.0 |
| CVE-2015-3209 | – | Jun 15 | Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted… Affected: 5.0 |
| CVE-2015-3456 | – | May 13 | The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or… Affected: 4.0; 5.0; 6.0; 7.0 |
| CVE-2015-1842 | – | Apr 10 | The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to… Affected: through 6.0 |
| CVE-2015-0271 | – | Mar 10 | The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path Affected: 5.0; 6.0 |
| CVE-2014-3691 | – | Mar 9 | Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended… Affected: 4.0; 5.0 |
| CVE-2014-9623 | – | Jan 23 | OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by… Affected: 5.0 |
| CVE-2014-9493 | – | Jan 7 | The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full… Affected: 4.0; 5.0 |
| CVE-2014-7821 | – | Nov 24 | OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the… Affected: 4.0 |
| CVE-2014-3615 | – | Nov 1 | The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution Affected: 5.0 |
| CVE-2014-8333 | – | Oct 31 | The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the… Affected: 5.0 |
| CVE-2014-3708 | – | Oct 31 | OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list… Affected: 5.0 |
| CVE-2014-7231 | – | Oct 8 | The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when… Affected: 5.0 |
| CVE-2014-7230 | – | Oct 8 | The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from… Affected: 5.0 |
| CVE-2014-3621 | – | Oct 2 | The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options… Affected: 5.0; 4.0 |
| CVE-2014-4615 | – | Aug 19 | The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno… Affected: 4.0 |
| CVE-2014-0042 | – | Jun 2 | OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature… Affected: 4.0 |
| CVE-2014-0041 | – | Jun 2 | OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL… Affected: 4.0 |
| CVE-2014-0040 | – | Jun 2 | OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from… Affected: 4.0 |
| CVE-2013-6470 | – | Jun 2 | The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, disables… Affected: 4.0 |
| CVE-2014-0071 | – | Apr 17 | PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and… Affected: 4.0 |
| CVE-2013-6393 | – | Feb 6 | The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application… Affected: 3.0; 4.0 |
| CVE-2013-6491 | – | Feb 2 | The python-qpid client (common/rpc/impl_qpid.py) in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpid_protocol is set to ssl, which allows remote attackers… Affected: 3.0 |
| CVE-2013-6391 | – | Dec 14 | The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows… Affected: 4.0 |
| CVE-2013-4214 | – | Nov 23 | rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on… Affected: 3.0 |
| CVE-2013-2029 | – | Nov 23 | nagios.upgrade_to_v3.sh, as distributed by Red Hat and possibly others for Nagios Core 3.4.4, 3.5.1, and earlier, allows local users to overwrite arbitrary files via a symlink… Affected: 3.0 |