CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1948 – openstack-glance: Glance Swift store backend password leak
https://notcve.org/view.php?id=CVE-2014-1948
14 Feb 2014 — OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log. OpenStack Image Registry and Delivery Service (Glance) 2013.2 hasta 2013.2.1 y Icehouse anterior a icehouse-2 registra una URL que contiene la contraseña de Swift store backend cuando falla la autenticación... • http://rhn.redhat.com/errata/RHSA-2014-0229.html • CWE-255: Credentials Management Errors CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2013-4354
https://notcve.org/view.php?id=CVE-2013-4354
23 Nov 2013 — The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary tenants by adding the tenant as a member of the image. El API anterior a 2,1 en OpenStack Image Registry and Delivery Service (Glance) hace que sea más fácil para los usuarios locales inyectar imágenes en inquilinos arbitrarios añadiendo el inquilino como un miembro de la imagen. • http://www.openwall.com/lists/oss-security/2013/09/19/2 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 7EXPL: 1CVE-2013-0212 – openstack-glance: Backend password leak in Glance error message
https://notcve.org/view.php?id=CVE-2013-0212
24 Feb 2013 — store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages. store/swift.py en OpenStack Glance Essex (2012.1), Folsom (2012.2) anterior a 2012.2.3, y Grizzly, cuando el modo singe tenant en Swift, guarda el usuario Swift remoto y el p... • https://github.com/LogSec/CVE-2013-0212 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.5EPSS: 1%CPEs: 3EXPL: 0CVE-2012-4573 – OpenStack: Glance Authentication bypass for image deletion
https://notcve.org/view.php?id=CVE-2012-4573
11 Nov 2012 — The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request, a different vulnerability than CVE-2012-5482. La API v1 en OpenStack Vistazo Grizzly, Folsom (2.012,2) y Essex (2012.1) permite a usuarios autenticados remotamente borrar imágenes de su elección no protegidas a través de una solicitud de eliminación de imágenes, una vulnerabilidad diferente a CVE-2012-5482. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092192.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 1%CPEs: 3EXPL: 0CVE-2012-5482
https://notcve.org/view.php?id=CVE-2012-5482
11 Nov 2012 — The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573. v2 API en OpenStack Glance Grizzly, Folsom (2012.2)y Essex (2012.1), permite a usuarios remotos autenticados, borrar imágenes no protegidas de su elección a través de una petición de borrado de imagen. NOTA: Esta vulnerabilidad existe por una solució... • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092192.html • CWE-264: Permissions, Privileges, and Access Controls •