Login Request a demo
OV
Product
Ovirt-engine
by Redhat · last CVE Aug 24, 2020
10
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 0High 2Medium 6Low 0
Severity
All severities10Critical0High2Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Ovirt-engine to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2017-7510
8.8
1%
Mar 25
In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface
Affected: 4.1.0
CVE-2014-7851
7.5
1%
Oct 16
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session…
Affected: 3.2.2; 3.3; 3.3; 3.3; 3.3.0.1; 3.3.1; +22 more
CVE-2015-1780
6.5
1%
Nov 22
oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center
Affected: All versions, or not specified
CVE-2016-3077
6.5
1%
Jun 6
The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs
Affected: All versions, or not specified
CVE-2016-3113
6.1
3%
Aug 7
Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML
Affected: All versions, or not specified
CVE-2020-10775
5.3
2%
Aug 24
An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing…
Affected: through 4.4
CVE-2018-1062
5.3
1%
Mar 6
A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk…
Affected: 4.1.0 before 4.1.9
CVE-2018-1000095
4.8
1%
Mar 13
oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting (XSS) vulnerability in the name/description of VMs portion of the web admin application
Affected: 4.2.0 through 4.2.2
CVE-2014-0151
–
1%
Feb 13
Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform…
Affected: through 3.5.0
CVE-2014-0152
–
2%
Sep 8
Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors
Affected: 3.0.0; 3.1.0; 3.2.0; 3.3.0; 3.3.2; 3.3.3; +3 more
Showing 10