CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2013-0293
https://notcve.org/view.php?id=CVE-2013-0293
10 Dec 2019 — oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation oVirt Node: la pantalla de bloqueo acepta F2 para la caiga del shell causando una escalada de privilegios • http://www.openwall.com/lists/oss-security/2013/02/28/13 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2012-4480
https://notcve.org/view.php?id=CVE-2012-4480
02 Dec 2019 — mom creates world-writable pid files in /var/run mom crea archivos pid de tipo world-writable en /var/run. • http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089658.html • CWE-269: Improper Privilege Management •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5518
https://notcve.org/view.php?id=CVE-2012-5518
25 Nov 2019 — vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate) vdsm: la generación de certificados tras creación del nodo, permitiendo que vdsm inicie y sirva peticiones de cualquier persona que tenga una clave coincidente (y un certificado). • http://www.openwall.com/lists/oss-security/2012/11/11/3 • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2013-4367
https://notcve.org/view.php?id=CVE-2013-4367
01 Nov 2019 — ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod() works when passed a mode of '-1'. ovirt-engine versión 3.2, ejecutado sobre el kernel de Linux versiones 3.1 y posteriores, crea determinados archivos de tipo world-writeable debido a un cambio de kernel ascendente que impactó cómo opera la función os.chmod() de python cuando pasó a un modo de "-1". • https://access.redhat.com/security/cve/cve-2013-4367 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10194 – ovirt-engine-metrics: disclosure of sensitive passwords in log files and ansible playbooks
https://notcve.org/view.php?id=CVE-2019-10194
11 Jul 2019 — Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts. Contraseñas confidenciales utilizadas en la implementación y configuración de oVirt Metrics, todas las versiones. Se detectó que no estaban suficientemente protegidas. Las contraseñas se pueden revelar en archivos de registro (si los playbooks se ejecutan... • http://www.securityfocus.com/bid/109140 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10139 – cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment
https://notcve.org/view.php?id=CVE-2019-10139
17 May 2019 — During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted. Durante la implementación de HE a través de cockpit-ovirt, cockpit-ovirt genera un archivo variable ansible `/ var / lib / ovirt-hosts-configuración-cockpit / ansibleVarFileXXXXXX.var` que contiene las contraseñas del admini... • http://www.securityfocus.com/bid/108396 • CWE-311: Missing Encryption of Sensitive Data CWE-522: Insufficiently Protected Credentials •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3879
https://notcve.org/view.php?id=CVE-2019-3879
25 Mar 2019 — It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests. Se ha observado que en la API REST de ovirt, en versiones anteriores a la 4.3.2.1, RemoveDiskCommand se activa como un comando interno, haciendo que se omita la validación del permi... • http://www.securityfocus.com/bid/107561 • CWE-862: Missing Authorization •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3831 – vdsm: privilege escalation to root via systemd_run
https://notcve.org/view.php?id=CVE-2019-3831
05 Mar 2019 — A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could be abused to execute arbitrary commands as root. Se ha detectado una vulnerabilidad en vdsm, desde la versión 4.19 hasta la 4.30.3 y desde la 4.30.5 hasta la 4.30.8.. La función systemd_run expuesta al usuario del sistema vdsm podría ser abusada para ejecutar comandos arbitrarios como root. The redhat-virtualization-host packages provide the Red Hat Vi... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3831 • CWE-863: Incorrect Authorization •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-10908
https://notcve.org/view.php?id=CVE-2018-10908
09 Aug 2018 — It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host. Se ha detectado que vdsm en versiones anteriores a la 4.20.37 invoca qemu-img en entradas no fiables sin limitar recursos. Mediante la subida de una imagen especialmente m... • http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.html • CWE-20: Improper Input Validation CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2017-15113
https://notcve.org/view.php?id=CVE-2017-15113
27 Jul 2018 — ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues. ovirt-engine en versiones anteriores a la 4.1.7.6 con el nivel de registro configurado en DEBUG incluye contraseñas en el archivo de registro sin enmascarar. Solo los administradores pueden cambiar ... • http://www.securityfocus.com/bid/101933 • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer CWE-532: Insertion of Sensitive Information into Log File •