CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2014-8578 – openstack-horizon: multiple XSS flaws
https://notcve.org/view.php?id=CVE-2014-8578
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475. Vulnerabilidad de XSS en el panel Groups en OpenStack Dashboard (Horizon) anterior a 2013.2.4, 2014.1 anterior a 2014.1.2, y Juno anterior a Juno-2 permite a administradores remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una dirección de email de un usuarios, una vulnerabilidad diferente a CVE-2014-3475. • http://www.openwall.com/lists/oss-security/2014/07/08/6 http://www.securityfocus.com/bid/68456 https://bugs.launchpad.net/horizon/+bug/1320235 https://access.redhat.com/security/cve/CVE-2014-8578 https://bugzilla.redhat.com/show_bug.cgi?id=1116090 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 1CVE-2014-3708 – openstack-nova: Nova network denial of service through API filtering
https://notcve.org/view.php?id=CVE-2014-3708
OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list active servers API request. OpenStack Compute (Nova) anterior a 2014.1.4 y 2014.2.x anterior a 2014.2.1 permite a usuarios remotos autenticados causar una denegación de servicio (consumo de CPU) a través de un filtro IP en una solicitud API para listar servidores activos. A denial of service flaw was found in the way OpenStack Compute (nova) looked up VM instances based on an IP address filter. An attacker with sufficient privileges on an OpenStack installation with a large amount of VMs could use this flaw to cause the main nova process to block for an extended amount of time. • http://lists.openstack.org/pipermail/openstack-announce/2014-October/000301.html http://rhn.redhat.com/errata/RHSA-2015-0843.html http://rhn.redhat.com/errata/RHSA-2015-0844.html http://www.securityfocus.com/bid/70777 https://bugs.launchpad.net/nova/+bug/1358583 https://access.redhat.com/security/cve/CVE-2014-3708 https://bugzilla.redhat.com/show_bug.cgi?id=1154951 • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.0EPSS: 0%CPEs: 4EXPL: 0CVE-2014-8333 – openstack-nova: Nova VMware instance in resize state may leak
https://notcve.org/view.php?id=CVE-2014-8333
The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state. El controlador VMware en OpenStack Compute (Nova) anterior a 2014.1.4 permite a usuarios remotos autenticados causar una denegación de servicio (consumo de disco) mediante la eliminación de un instancia en el estado resize. A flaw was found in the OpenStack Compute (nova) VMWare driver, which could allow an authenticated user to delete an instance while it was in the resize state, causing the instance to remain on the back end. A malicious user could use this flaw to cause a denial of service by exhausting all available resources on the system. • http://lists.openstack.org/pipermail/openstack-announce/2014-October/000298.html http://rhn.redhat.com/errata/RHSA-2015-0843.html http://rhn.redhat.com/errata/RHSA-2015-0844.html http://secunia.com/advisories/60531 https://bugs.launchpad.net/nova/+bug/1359138 https://access.redhat.com/security/cve/CVE-2014-8333 https://bugzilla.redhat.com/show_bug.cgi?id=1154890 • CWE-399: Resource Management Errors CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-7960 – openstack-swift: Swift metadata constraints are not correctly enforced
https://notcve.org/view.php?id=CVE-2014-7960
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined. OpenStack Object Storage (Swift) anterior a 2.2.0 permite a usuarios remotos autenticados evadir las restricciones max_meta_count y otros metadatos a través de múlitples peticiones manipuladas que exceden el límite cuando éstas se combinan. A flaw was found in the metadata constraints in OpenStack Object Storage (swift). By adding metadata in several separate calls, a malicious user could bypass the max_meta_count constraint, and store more metadata than allowed by the configuration. • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html http://rhn.redhat.com/errata/RHSA-2015-0835.html http://rhn.redhat.com/errata/RHSA-2015-0836.html http://rhn.redhat.com/errata/RHSA-2015-1495.html http://www.openwall.com/lists/oss-security/2014/10/07/39 http://www.openwall.com/lists/oss-security/2014/10/08/7 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.securityfocus.com/bid/70279 http://www.ubuntu& • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2014-8750 – openstack-nova: Nova VMware driver may connect VNC to another tenant's console
https://notcve.org/view.php?id=CVE-2014-8750
Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances. Condición de carrera en el driver de VMware en OpenStack Compute (Nova) anterior a 2014.1.4 y 2014.2 anterior a 2014.2rc1, permite a usuarios remotos autenticados acceder a consolas no intencionadas, mediante una instancia que desencadena que el mismo puerto VNC sea asignado a dos instancias diferentes. A race condition flaw was found in the way the nova VMware driver handled VNC port allocation. An authenticated user could use this flaw to gain unauthorized console access to instances belonging to other tenants by repeatedly spawning new instances. Note that only nova setups using the VMware driver and the VNC proxy service were affected. • http://lists.openstack.org/pipermail/openstack-announce/2014-October/000293.html http://rhn.redhat.com/errata/RHSA-2014-1689.html http://rhn.redhat.com/errata/RHSA-2014-1781.html http://rhn.redhat.com/errata/RHSA-2014-1782.html http://secunia.com/advisories/60227 http://www.openwall.com/lists/oss-security/2014/10/14/9 http://www.securityfocus.com/bid/70182 https://bugs.launchpad.net/nova/+bug/1357372 https://access.redhat.com/security/cve/CVE-2014-8750 https:/&#x • CWE-285: Improper Authorization CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •