suse/openstack-nova&distro=SUSE OpenStack Cloud 7

Vulnerabilities (56)

• CVE-2020-10743Jun 2, 2021
  affected < 14.0.11~dev13-4.40.2fixed 14.0.11~dev13-4.40.2

  It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP's distribution of Kibana,

• CVE-2020-17376Aug 26, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that shar

• CVE-2020-11110Jul 27, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

• CVE-2020-10177Jun 25, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

• CVE-2020-10994Jun 25, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

• CVE-2020-10378Jun 25, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.

• CVE-2020-13379Jun 3, 2020
  affected < 14.0.11~dev13-4.40.2fixed 14.0.11~dev13-4.40.2

  The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information abo

• CVE-2020-13596Jun 3, 2020
  affected < 14.0.11~dev13-4.40.2fixed 14.0.11~dev13-4.40.2

  An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

• CVE-2020-13254Jun 3, 2020
  affected < 14.0.11~dev13-4.40.2fixed 14.0.11~dev13-4.40.2

  An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

• CVE-2018-18625Jun 2, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

• CVE-2018-18624Jun 2, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

• CVE-2018-18623Jun 2, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

• CVE-2020-11077May 22, 2020
  affected < 14.0.11~dev13-4.40.2fixed 14.0.11~dev13-4.40.2

  In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mis

• CVE-2020-11076May 22, 2020
  affected < 14.0.11~dev13-4.40.2fixed 14.0.11~dev13-4.40.2

  In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

• CVE-2020-10744May 15, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18

• CVE-2020-8151May 12, 2020
  affected < 14.0.11~dev13-4.40.2fixed 14.0.11~dev13-4.40.2

  There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.

• CVE-2020-10663Apr 28, 2020
  affected < 14.0.11~dev13-4.40.2fixed 14.0.11~dev13-4.40.2

  The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically,

• CVE-2020-12052Apr 27, 2020
  affected < 14.0.11~dev13-4.40.2fixed 14.0.11~dev13-4.40.2

  Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

• CVE-2018-17954Apr 3, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue a

• CVE-2020-1733Mar 11, 2020
  affected < 14.0.11~dev13-4.45.3fixed 14.0.11~dev13-4.45.3

  A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is cr