ovirt-engine
8 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-7259 | < 4.5.7 | Ovirt-engine: potential exposure of cleartext provider passwords via web ui | MEDIUM 4.9 | 0.3 % | ||
| CVE-2024-0822 | 4.5.0 – < 4.5.6 | Ovirt: authentication bypass | HIGH 7.5 | 0.7 % | ||
| CVE-2022-2805 | ovirt-engine 4.5.3 | A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows | MEDIUM 6.5 | 0.5 % | ||
| CVE-2022-3193 | ovirt-engine 4.3 | An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description" fails to | MEDIUM 6.1 | 0.5 % | ||
| CVE-2020-35497 | ovirt-engine 4.4.3 and earlier | A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, | MEDIUM 6.5 | 0.8 % | ||
| CVE-2020-10775 | ovirt-engine versions before 4.4.2 | An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arb | MEDIUM 5.3 | 1.8 % | ||
| CVE-2019-3879 | 4.3.2.1 | It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the pe | HIGH 8.1 | 1.8 % | ||
| CVE-2018-1074 | ovirt-engine 4.2.2.5 ; ovirt-engine 4.1.11.2 | ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credential | HIGH 7.7 | 1.4 % |