OV
Vendor
Ovirt
35
CVEs
1
On KEV
0
New 30D
Products
OV7.8
Ovirt-engine
Ovirt
9 CVEs1 on KEV0 new
OV9.8
Ovirt
Ovirt
12 CVEs0 on KEV0 new
VD7.5
Vdsm
Ovirt
4 CVEs0 on KEV0 new
NO8.8
Node
Ovirt
2 CVEs0 on KEV0 new
CO7.8
Cockpit-ovirt
Ovirt
1 CVEs0 on KEV0 new
LC5.5
Log Collector
Ovirt
1 CVEs0 on KEV0 new
MO7.8
Mom
Ovirt
1 CVEs0 on KEV0 new
OV9.8
Ovirt-ansible-roles
Ovirt
1 CVEs0 on KEV0 new
OV–
Ovirt-engine-cli
Ovirt
1 CVEs0 on KEV0 new
OV7.8
Ovirt-hosted-engine-setup
Ovirt
1 CVEs0 on KEV0 new
OV8.8
Ovirt-node
Ovirt
1 CVEs0 on KEV0 new
SA–
Sanlock
Ovirt
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-7259 | OV Ovirt-engine Ovirt | 4.9 | Sep 26 | A flaw was found in oVirt |
| CVE-2024-0822 | OV Ovirt-engine Ovirt | 7.5 | Jan 25 | An authentication bypass vulnerability was found in overt-engine |
| CVE-2022-3193 | OV Ovirt-engine Ovirt | 6.1 | Sep 28 | An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine |
| CVE-2022-2806 | LC Log Collector Ovirt | 5.5 | Sep 1 | It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered |
| CVE-2022-0207 | VD Vdsm Ovirt | 4.7 | Aug 26 | A race condition was found in vdsm |
| CVE-2022-0435 | NO Node Ovirt | 8.8 | Mar 25 | A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes… |
| CVE-2022-0847 In wildKEV | OV Ovirt-engine Ovirt | 7.8 | Mar 7 | Linux Kernel Privilege Escalation Vulnerability |
| CVE-2020-35497 | OV Ovirt-engine Ovirt | 6.5 | Dec 21 | A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key |
| CVE-2020-14333 | OV Ovirt-engine Ovirt | 6.1 | Aug 18 | A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site… |
| CVE-2019-19336 | OV Ovirt-engine Ovirt | 6.1 | Mar 19 | A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8 |
| CVE-2013-0293 | NO Node Ovirt | 7.8 | Dec 10 | oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation |
| CVE-2012-4480 | MO Mom Ovirt | 7.8 | Dec 2 | mom creates world-writable pid files in /var/run |
| CVE-2012-5518 | VD Vdsm Ovirt | 7.5 | Nov 25 | vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate) |
| CVE-2013-4367 | OV Ovirt-engine Ovirt | 7.8 | Nov 1 | ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod() works when… |
| CVE-2019-10194 | OV Ovirt Ovirt | 5.5 | Jul 11 | Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions |
| CVE-2019-10139 | CO Cockpit-ovirt Ovirt | 7.8 | May 17 | During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the… |
| CVE-2019-3879 | OV Ovirt Ovirt | 8.1 | Mar 25 | It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be… |
| CVE-2019-3831 | VD Vdsm Ovirt | 6.7 | Mar 25 | A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8 |
| CVE-2018-10908 | VD Vdsm Ovirt | 6.3 | Aug 9 | It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources |
| CVE-2017-15113 | OV Ovirt Ovirt | 6.6 | Jul 27 | ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking |
| CVE-2018-1072 | OV Ovirt Ovirt | 9.8 | Jun 26 | ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files |
| CVE-2018-1117 | OV Ovirt-ansible-roles Ovirt | 9.8 | Jun 20 | ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently… |
| CVE-2018-1073 | OV Ovirt-engine Ovirt | 5.3 | Jun 19 | The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names… |
| CVE-2018-1075 | OV Ovirt Ovirt | 7.8 | Jun 12 | ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning |
| CVE-2018-1074 | OV Ovirt Ovirt | 7.2 | Apr 26 | ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to… |
| CVE-2018-1000018 | OV Ovirt-hosted-engine-setup Ovirt | 7.8 | Jan 24 | An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file |
| CVE-2014-7851 | OV Ovirt Ovirt | 7.5 | Oct 16 | oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session… |
| CVE-2014-8170 | OV Ovirt-node Ovirt | 8.8 | Sep 26 | ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly… |
| CVE-2016-6341 | OV Ovirt Ovirt | 5.5 | Apr 20 | oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading… |
| CVE-2014-0154 | OV Ovirt Ovirt | – | Feb 13 | oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive… |
| CVE-2014-0153 | OV Ovirt Ovirt | – | Sep 8 | The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page |
| CVE-2014-0152 | OV Ovirt Ovirt | – | Sep 8 | Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors |
| CVE-2012-5638 | SA Sanlock Ovirt | – | Dec 20 | The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended… |
| CVE-2012-3533 | OV Ovirt-engine-cli Ovirt | – | Aug 31 | The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a… |