CVSS: 4.0EPSS: 0%CPEs: 35EXPL: 0CVE-2013-4155 – OpenStack: Swift Denial of Service using superfluous object tombstones
https://notcve.org/view.php?id=CVE-2013-4155
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected. OpenStack Swift nateior a 1.9.1 en Folsom, Grizzly, y Havana, permite a usuarios autenticados provocar una denegación de servicio (consumo superfluo de tombstone y desaceleración del clúster Swift) a través de una petición DELETE con un timestamp que es más antiguo que el esperado. • http://rhn.redhat.com/errata/RHSA-2013-1197.html http://www.debian.org/security/2012/dsa-2737 http://www.openwall.com/lists/oss-security/2013/08/07/6 http://www.ubuntu.com/usn/USN-2001-1 https://bugs.launchpad.net/swift/+bug/1196932 https://review.openstack.org/#/c/40643 https://review.openstack.org/#/c/40645 https://review.openstack.org/#/c/40646 https://access.redhat.com/security/cve/CVE-2013-4155 https://bugzilla.redhat.com/show_bug. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2013-2161 – Swift: Unchecked user input in Swift XML responses
https://notcve.org/view.php?id=CVE-2013-2161
XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name. Vulnerabilidad de inyección XML en accounts/utils.py en OpenStack Swift Folsom, Grizzly, y Havana, permite a atacantes provocar o suplantar respuestas Swift a través de un nombre de cuenta. • http://lists.opensuse.org/opensuse-updates/2013-07/msg00021.html http://rhn.redhat.com/errata/RHSA-2013-0993.html http://www.debian.org/security/2012/dsa-2737 http://www.openwall.com/lists/oss-security/2013/06/13/4 https://bugs.launchpad.net/swift/+bug/1183884 https://access.redhat.com/security/cve/CVE-2013-2161 https://bugzilla.redhat.com/show_bug.cgi?id=972988 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 2.1EPSS: 0%CPEs: 3EXPL: 0CVE-2013-2096
https://notcve.org/view.php?id=CVE-2013-2096
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data. Folsom, Grizzly y Havana de OpenStack Compute (Nova), no comprueba el tamaño virtual de una imagen QCOW2, lo que permite a los usuarios locales causar una denegación de servicio (consumo de disco del sistema de archivos host) creando una imagen con un gran tamaño virtual que sí, no contiene una gran cantidad de datos. • http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html http://www.securityfocus.com/bid/59924 http://www.ubuntu.com/usn/USN-1831-1 https://review.openstack.org/#/c/28717 https://review.openstack.org/#/c/28901 https://review.openstack.org/#/c/29192 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 1%CPEs: 6EXPL: 0CVE-2013-1838 – Nova: DoS by allocating all Fixed IPs
https://notcve.org/view.php?id=CVE-2013-1838
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to the addFixedIp function. OpenStack Compute (Nova) Grizzly, Folsom (versión 2012.2) y Essex (versión 2012.1) no implementan apropiadamente una cuota para direcciones IP fijas, lo que permite a los usuarios autenticados remotos causar una denegación de servicio (agotamiento de recursos y fallo para crear nuevas instancias) por medio de un gran número de llamadas a la función addFixedIp. • http://osvdb.org/91303 http://rhn.redhat.com/errata/RHSA-2013-0709.html http://secunia.com/advisories/52580 http://secunia.com/advisories/52728 http://ubuntu.com/usn/usn-1771-1 http://www.openwall.com/lists/oss-security/2013/03/14/18 http://www.securityfocus.com/bid/58492 https://bugs.launchpad.net/nova/+bug/1125468 https://bugzilla.redhat.com/show_bug.cgi?id=919648 https://exchange.xforce.ibmcloud.com/vulnerabilities/82877 https://lists.launchpad.net/openstack& • CWE-399: Resource Management Errors •
CVSS: 6.0EPSS: 0%CPEs: 6EXPL: 0CVE-2013-0335 – nova: VNC proxy can connect to the wrong VM
https://notcve.org/view.php?id=CVE-2013-0335
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port. OpenStack Compute (Nova) Grizzly, Folsom (v2012.2) y Essex (v2012.1) permite a usuarios remotos autenticados acceder a una máquina virtual en circunstancias oportunistas utilizando el token VNC para eliminar una máquina virtual que se dirigía al mismo puerto VNC. • http://rhn.redhat.com/errata/RHSA-2013-0709.html http://secunia.com/advisories/52337 http://secunia.com/advisories/52728 http://www.openwall.com/lists/oss-security/2013/02/26/7 http://www.osvdb.org/90657 http://www.ubuntu.com/usn/USN-1771-1 https://bugs.launchpad.net/nova/+bug/1125378 https://review.openstack.org/#/c/22086 https://review.openstack.org/#/c/22758 https://review.openstack.org/#/c/22872 https://access.redhat.com/security/cve • CWE-264: Permissions, Privileges, and Access Controls •