suse/openstack-neutron-lbaas&distro=SUSE OpenStack Cloud Crowbar 8

Vulnerabilities (18)

• CVE-2019-15043Sep 3, 2019
  affected < 11.0.4~dev6-3.15.4fixed 11.0.4~dev6-3.15.4

  In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.

• CVE-2019-5477Aug 16, 2019
  affected < 11.0.4~dev6-3.15.4fixed 11.0.4~dev6-3.15.4

  A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input a

• CVE-2019-13611Jul 15, 2019
  affected < 11.0.4~dev6-3.15.4fixed 11.0.4~dev6-3.15.4

  An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.

• CVE-2019-2628Apr 23, 2019
  affected < 11.0.4~dev6-3.15.4fixed 11.0.4~dev6-3.15.4

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compr

• CVE-2019-2627Apr 23, 2019
  affected < 11.0.4~dev6-3.15.4fixed 11.0.4~dev6-3.15.4

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with networ

• CVE-2019-2614Apr 23, 2019
  affected < 11.0.4~dev6-3.15.4fixed 11.0.4~dev6-3.15.4

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network acces

• CVE-2019-11068Apr 10, 2019
  affected < 11.0.4~dev6-3.9.1fixed 11.0.4~dev6-3.9.1

  libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

• CVE-2019-10876Apr 5, 2019
  affected < 11.0.4~dev6-3.9.1fixed 11.0.4~dev6-3.9.1

  An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes

• CVE-2019-9735Mar 13, 2019
  affected < 11.0.4~dev6-3.12.1fixed 11.0.4~dev6-3.12.1

  An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example,

• CVE-2019-6975Feb 11, 2019
  affected < 11.0.4~dev6-3.9.1fixed 11.0.4~dev6-3.9.1

  Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

• CVE-2019-3498Jan 9, 2019
  affected < 11.0.4~dev6-3.9.1fixed 11.0.4~dev6-3.9.1

  In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a use

• CVE-2018-19039Dec 13, 2018
  affected < 11.0.4~dev6-3.15.4fixed 11.0.4~dev6-3.15.4

  Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

• CVE-2018-15727Aug 29, 2018
  affected < 11.0.4~dev6-3.15.4fixed 11.0.4~dev6-3.15.4

  Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

• CVE-2018-14574Aug 3, 2018
  affected < 11.0.4~dev6-3.9.1fixed 11.0.4~dev6-3.9.1

  django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

• CVE-2018-14432Jul 31, 2018
  affected < 11.0.4~dev4-3.3.4fixed 11.0.4~dev4-3.3.4

  In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access

• CVE-2017-17051HigDec 5, 2017
  affected < 11.0.4~dev6-3.12.1fixed 11.0.4~dev6-3.12.1

  An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This

• CVE-2016-10127CriMar 3, 2017
  affected < 11.0.4~dev6-3.15.4fixed 11.0.4~dev6-3.15.4

  PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

• CVE-2015-3448Apr 29, 2015
  affected < 11.0.4~dev6-3.12.1fixed 11.0.4~dev6-3.12.1

  REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.