İçeriğe atla
Noroxi

oVirt kayıtları

oVirt üreticisine ait 34 yayımlanmış kayıt. Bunların 1 tanesi sahada sömürüldü (CISA KEV listesinde), 1 tanesi için hazır saldırı aracı var.

Ürüne göre süzün ↓

Araştırmacı profili

KEV’e giren
1 · %2,9
Silahlaştırılmış
1 · %2,9
Pre-auth RCE
0
Düzeltme kaydı olan
%73,5
Yayından KEV’e ortanca
46 gün

Pre-auth RCE: saldırganın hesabı olmadan, ağ üzerinden kod çalıştırabildiği açıklar. Yayından KEV’e ortanca: sahada sömürülen kayıtların yayımlanmasıyla CISA listesine girmesi arasındaki tipik süre.

Yıllara göre kayıt

  1. 17
  2. 18
  3. 19
  4. 20
  5. 22
  6. 24

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

34 kayıt
  • CVE-2022-0847
    89Hemen

    A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %92

    linux · linux kernel10 Mar 2022

  • CVE-2022-0435
    55Planlayın

    A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content wh

    YüksekCVSS 8,8Kavram kanıtıEPSS %67

    linux · linux kernel25 Mar 2022

  • CVE-2018-1117
    39İzleyin

    ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to Mana

    KritikCVSS 9,8İstismar yokEPSS %1

    ovirt · ovirt-ansible-roles19 Haz 2018

  • CVE-2018-1072
    39İzleyin

    ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files.

    KritikCVSS 9,8İstismar yokEPSS %0

    ovirt · ovirt26 Haz 2018

  • CVE-2014-8170
    36İzleyin

    ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterp

    YüksekCVSS 8,8İstismar yokEPSS %3

    ovirt · ovirt-node25 Eyl 2017

  • CVE-2019-3879
    33İzleyin

    It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the pe

    YüksekCVSS 8,1İstismar yokEPSS %1

    ovirt · ovirt25 Mar 2019

  • CVE-2018-1000018
    31İzleyin

    An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file.

    YüksekCVSS 7,8İstismar yokEPSS %0

    ovirt · ovirt-hosted-engine-setup24 Oca 2018

  • CVE-2013-0293
    31İzleyin

    oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation

    YüksekCVSS 7,8İstismar yokEPSS %0

    ovirt · node10 Ara 2019

  • CVE-2012-4480
    31İzleyin

    mom creates world-writable pid files in /var/run

    YüksekCVSS 7,8İstismar yokEPSS %0

    ovirt · mom2 Ara 2019

  • CVE-2018-1075
    31İzleyin

    ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning.

    YüksekCVSS 7,8İstismar yokEPSS %0

    ovirt · ovirt12 Haz 2018

  • CVE-2013-4367
    31İzleyin

    ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted

    YüksekCVSS 7,8İstismar yokEPSS %0

    ovirt · ovirt-engine1 Kas 2019

  • CVE-2019-10139
    31İzleyin

    During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansible

    YüksekCVSS 7,8İstismar yokEPSS %0

    ovirt · cockpit-ovirt17 May 2019

  • CVE-2014-7851
    30İzleyin

    oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users wi

    YüksekCVSS 7,5İstismar yokEPSS %1

    ovirt · ovirt16 Eki 2017

  • CVE-2012-5518
    30İzleyin

    vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificat

    YüksekCVSS 7,5İstismar yokEPSS %0

    ovirt · vdsm25 Kas 2019

  • CVE-2024-0822
    30İzleyin

    Ovirt: authentication bypass

    YüksekCVSS 7,5İstismar yokEPSS %0

    ovirt · ovirt-engine25 Oca 2024

  • CVE-2014-0152
    28İzleyin

    Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unsp

    OrtaCVSS 6,8İstismar yokEPSS %1

    ovirt · ovirt8 Eyl 2014

  • CVE-2018-1074
    28İzleyin

    ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credential

    YüksekCVSS 7,2İstismar yokEPSS %1

    ovirt · ovirt26 Nis 2018

  • CVE-2017-15113
    26İzleyin

    ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking.

    OrtaCVSS 6,6İstismar yokEPSS %1

    ovirt · ovirt27 Tem 2018

  • CVE-2019-3831
    26İzleyin

    A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8.

    OrtaCVSS 6,7İstismar yokEPSS %1

    ovirt · vdsm25 Mar 2019

  • CVE-2020-35497
    26İzleyin

    A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name,

    OrtaCVSS 6,5İstismar yokEPSS %0

    ovirt · ovirt-engine21 Ara 2020

  • CVE-2018-10908
    25İzleyin

    It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources.

    OrtaCVSS 6,3İstismar yokEPSS %1

    ovirt · vdsm9 Ağu 2018

  • CVE-2019-19336
    24İzleyin

    A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8.

    OrtaCVSS 6,1İstismar yokEPSS %0

    ovirt · ovirt-engine19 Mar 2020

  • CVE-2020-14333
    24İzleyin

    A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely,

    OrtaCVSS 6,1İstismar yokEPSS %0

    ovirt · ovirt-engine18 Ağu 2020

  • CVE-2022-3193
    24İzleyin

    An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine.

    OrtaCVSS 6,1İstismar yokEPSS %0

    ovirt · ovirt-engine28 Eyl 2022

  • CVE-2018-1073
    22İzleyin

    The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allo

    OrtaCVSS 5,3İstismar yokEPSS %1

    ovirt · ovirt-engine19 Haz 2018