CVE-2024-7259

< 4.5.7

A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to

4.9MEDIUM

CVE-2024-0822

all versions

An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without aut

7.5HIGH

CVE-2022-3193

all versions

An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description

6.1MEDIUM

CVE-2022-2806

< 4.4.7-2.el8ev

It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-

5.5MEDIUM

CVE-2022-0207

>= 4.30.1 and < 4.50.0.4

A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored

4.7MEDIUM

CVE-2022-0435

all versions

A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious

8.8HIGH

CVE-2022-0847

all versions

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_

7.8HIGH

CVE-2020-35497

<= 4.4.3

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, inclu

6.5MEDIUM

CVE-2020-14333

<= 4.4.0

A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters co

6.3MEDIUM

CVE-2019-19336

< 4.3.8

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL par

6.1MEDIUM

CVE-2013-0293

all versions

oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation

7.8HIGH

CVE-2012-4480

< 0.3.0-1

mom creates world-writable pid files in /var/run

7.8HIGH

CVE-2012-5518

all versions

vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and

7.5HIGH

CVE-2013-4367

all versions

ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change whic

7.8HIGH

CVE-2019-10194

all versions

Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected

5.5MEDIUM

CVE-2019-10139

all versions

During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockp

7.8HIGH

CVE-2019-3879

< 4.3.2.1

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, mean

8.1HIGH

CVE-2019-3831

>= 4.19 and <= 4.30.3

A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to

6.7MEDIUM

CVE-2018-10908

< 4.20.37

It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a spec

6.5MEDIUM

CVE-2017-15113

< 4.1.7.6

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administr

7.2HIGH

CVE-2018-1072

< 4.2.2

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run wit

5.0MEDIUM

CVE-2018-1117

< 1.0.6

ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provid

5.0MEDIUM

CVE-2018-1073

< 4.2.3

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passw

5.3MEDIUM

CVE-2018-1075

< 4.2.3

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup w

5.0MEDIUM

CVE-2018-1074

<= 4.1.11.1

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management

7.7HIGH

CVE-2018-1000018

< 2.2.7

An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file.

7.8HIGH

CVE-2014-7851

all versions

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticate

7.5HIGH

CVE-2014-8170

all versions

ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red

8.8HIGH

CVE-2016-6341

<= 4.0.2

oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to o

5.5MEDIUM

CVE-2014-0154

<= 3.4.4

oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for

CVE-2014-0153

<= 3.4.0

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensiti

CVE-2014-0152

<= 3.4.0

Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web session

CVE-2012-3533

<= 3.1.0.5

The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client ke