CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2012-5482
https://notcve.org/view.php?id=CVE-2012-5482
The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573. v2 API en OpenStack Glance Grizzly, Folsom (2012.2)y Essex (2012.1), permite a usuarios remotos autenticados, borrar imágenes no protegidas de su elección a través de una petición de borrado de imagen. NOTA: Esta vulnerabilidad existe por una solución incompleta para CVE-2012-4573. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092192.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00002.html http://osvdb.org/87248 http://secunia.com/advisories/51174 http://www.openwall.com/lists/oss-security/2012/11/07/6 http://www.openwall.com/lists/oss-security/2012/11/08/2 http://www.openwall.com/lists/oss-security/2012/11/09/1 http://www.openwall.com/lists/oss-security/2012/11/09/5 http://www.securityfocus&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2012-4573 – OpenStack: Glance Authentication bypass for image deletion
https://notcve.org/view.php?id=CVE-2012-4573
The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request, a different vulnerability than CVE-2012-5482. La API v1 en OpenStack Vistazo Grizzly, Folsom (2.012,2) y Essex (2012.1) permite a usuarios autenticados remotamente borrar imágenes de su elección no protegidas a través de una solicitud de eliminación de imágenes, una vulnerabilidad diferente a CVE-2012-5482. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092192.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00002.html http://osvdb.org/87248 http://packetstormsecurity.com/files/118733/Red-Hat-Security-Advisory-2012-1558-01.html http://rhn.redhat.com/errata/RHSA-2012-1558.html http://secunia.com/advisories/51174 http://secunia.com/advisories/51234 http://www.openwall.com/lists/oss-security/2012/11/07/6 http://www.openwall.com/lists/oss-secu • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 2CVE-2012-3447
https://notcve.org/view.php?id=CVE-2012-3447
virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361. virt/disk/api.py en OpenStack Compute (Nova) v2012.1.x antes de v2012.1.2 y Folsom antes de Folsom-3 permite a usuarios remotos autenticados sobreescribir archivos de su elección mediante un ataque de enlaces simbólicos en una imagen que utiliza un enlace simbólico que es sólo legible por el usuario root. NOTA: esta vulnerabilidad se debe a un arreglo incompleto para CVE-2012-3361. • http://www.openwall.com/lists/oss-security/2012/08/07/1 http://www.securityfocus.com/bid/54869 https://bugs.launchpad.net/nova/+bug/1031311 https://bugzilla.redhat.com/show_bug.cgi?id=845106 https://exchange.xforce.ibmcloud.com/vulnerabilities/77539 https://github.com/openstack/nova/commit/ce4b2e27be45a85b310237615c47eb53f37bb5f3 https://github.com/openstack/nova/commit/d9577ce9f266166a297488445b5b0c93c1ddb368 https://review.openstack.org/#/c/10953 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 2CVE-2012-3371
https://notcve.org/view.php?id=CVE-2012-3371
The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled, allows remote authenticated users to cause a denial of service (excessive database lookup calls and server hang) via a request with many repeated IDs in the os:scheduler_hints section. El planificador Nova en OpenStack Compute (Nova) Folsom (2012.2) y Essex (2012.1), cuando DifferentHostFilter o SameHostFilter están activados, permite a usuarios remotos autenticados provocar una denegación de servicio (exceso de llamadas de búsqueda de base de datos y el servidor se bloquea) a través de una solicitud con muchos identificadores repetidos en el sistema operativo: Sección scheduler_hints. • http://www.openwall.com/lists/oss-security/2012/07/11/13 http://www.securityfocus.com/bid/54388 http://www.ubuntu.com/usn/USN-1501-1 https://bugs.launchpad.net/nova/+bug/1017795 https://github.com/openstack/nova/commit/034762e8060dcf0a11cb039b9d426b0d0bb1801d https://lists.launchpad.net/openstack/msg14452.html • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2012-3360
https://notcve.org/view.php?id=CVE-2012-3360
Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element. Vulnerabilidad de salto de directorio en virt/disk/api.py en OpenStack Compute (Nova) Folsom (2.012,2) y Essex (2.012,1), cuando se utiliza durante libvirt basados ??en hipervisores, permite a usuarios remotos autenticados escribir archivos arbitrarios a la imagen de disco a través de un. . (punto punto) en el atributo de ruta de un elemento de archivo • http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html http://secunia.com/advisories/49763 http://secunia.com/advisories/49802 http://www.securityfocus.com/bid/54277 http://www.ubuntu.com/usn/USN-1497-1 https://bugs.launchpad.net/nova/+bug/1015531 https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7 https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9 https://lists.launchpad.net/openstack/msg14089.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •