CVSS: 7.4EPSS: 0%CPEs: 7EXPL: 3CVE-2021-3563
https://notcve.org/view.php?id=CVE-2021-3563
26 Aug 2022 — A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. Se ha encontrado un fallo en openstack-keystone. Sólo son verificados los primeros 72 caracteres del secreto de una aplicación, lo que permite a atacantes omitir determinada complejidad de las contraseñas con la que pueden conta... • https://access.redhat.com/security/cve/CVE-2021-3563 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23452 – openstack-barbican: Barbican allows anyone with an admin role to add their secrets to a different project's containers
https://notcve.org/view.php?id=CVE-2022-23452
23 Jun 2022 — An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service. Se ha encontrado un fallo de autorización en openstack-barbican, donde cualquier persona con un rol de administrador puede añadir secretos a un contenedor de proyecto diferente. Este fallo permite a un atacante en la red consumir recursos protegidos y causar una dene... • https://access.redhat.com/security/cve/CVE-2022-23452 • CWE-863: Incorrect Authorization •
CVSS: 8.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-23451 – openstack-barbican: Barbican allows authenticated users to add/modify/delete arbitrary metadata on any secret
https://notcve.org/view.php?id=CVE-2022-23451
26 Apr 2022 — An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources. Se ha encontrado un fallo de autorización en openstack-barbican. Las reglas de política por defecto para la API de metadatos secretos permitían a cualquier... • https://access.redhat.com/security/cve/CVE-2022-23451 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 1CVE-2022-0718 – python-oslo-utils: incorrect password masking in debug output
https://notcve.org/view.php?id=CVE-2022-0718
24 Mar 2022 — A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext. Se ha encontrado un fallo en python-oslo-utils. Debido a un análisis inapropiado, las contraseñas con comillas dobles ( " ) causan un enmascaramiento incorrecto en los registros de depuración, causando que cualquier parte de la contraseña después de las comillas dobles sea texto plano It was... • https://access.redhat.com/security/cve/CVE-2022-0718 • CWE-522: Insufficiently Protected Credentials CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.1EPSS: 90%CPEs: 5EXPL: 1CVE-2021-3654 – openstack-nova: novnc allows open redirection
https://notcve.org/view.php?id=CVE-2021-3654
02 Mar 2022 — A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL. Se ha encontrado una vulnerabilidad en el proxy de consola de openstack-nova, noVNC. Mediante el diseño de una URL maliciosa, noVNC puede ser redirigido a cualquier URL deseada A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL. • https://bugs.launchpad.net/nova/+bug/1927677 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 0CVE-2021-3620 – Ansible: ansible-connection module discloses sensitive info in traceback error message
https://notcve.org/view.php?id=CVE-2021-3620
15 Oct 2021 — A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality. Se ha encontrado un fallo en el módulo ansible-connection de Ansible Engine, en el que información confidencial, como las credenciales de usuario de Ansible, es revelado por defecto en el mensaje de error de rastreo. La mayor amenaza de esta vulnerabilidad es l... • https://bugzilla.redhat.com/show_bug.cgi?id=1975767 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2021-20267 – Ubuntu Security Notice USN-6067-1
https://notcve.org/view.php?id=CVE-2021-20267
28 May 2021 — A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neut... • https://bugzilla.redhat.com/show_bug.cgi?id=1934330 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-1690 – openstack-selinux: policy flaw allows dbus messaging
https://notcve.org/view.php?id=CVE-2020-1690
28 Oct 2020 — An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack (RHOSP) containers could send messages to the dbus. With access to the dbus, the attacker could start or stop services, possibly causing a denial of service. Versions before openstack-selinux 0.8.24 are affected. Se ha detectado un fallo de autorización inapropiada en la política aplicada d... • https://bugzilla.redhat.com/show_bug.cgi?id=1789640 • CWE-285: Improper Authorization •
CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 0CVE-2020-10731 – openstack-tripleo-heat-templates: No sVirt protection for OSP16 VMs due to disabled SELinux
https://notcve.org/view.php?id=CVE-2020-10731
29 Jul 2020 — A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines. Se encontró un fallo en el contenedor nova_libvirt provisto por el Red Hat OpenStack Platform versión 16, donde no se encuentra habilitado SELinux. Este fallo causa que sVirt, un importante mecanismo de aislamiento, se deshabilite para todas las máquinas virtuales en eje... • https://bugzilla.redhat.com/show_bug.cgi?id=1831544 • CWE-284: Improper Access Control CWE-1220: Insufficient Granularity of Access Control •