Vulnerabilities (CVE)

Filtered by vendor Redhat Subscribe
Filtered by product Virtualization Manager
Total 13 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2018-3639 12 Arm, Canonical, Debian and 9 more 321 Cortex-a, Ubuntu Linux, Debian Linux and 318 more 2024-11-21 2.1 LOW 5.5 MEDIUM
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.
CVE-2018-1059 3 Canonical, Dpdk, Redhat 9 Ubuntu Linux, Data Plane Development Kit, Ceph Storage and 6 more 2024-11-21 2.9 LOW 6.1 MEDIUM
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
CVE-2017-9214 3 Debian, Openvswitch, Redhat 6 Debian Linux, Openvswitch, Enterprise Linux and 3 more 2024-11-21 7.5 HIGH 9.8 CRITICAL
In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`.
CVE-2019-11358 11 Backdropcms, Debian, Drupal and 8 more 105 Backdrop, Debian Linux, Drupal and 102 more 2024-02-16 4.3 MEDIUM 6.1 MEDIUM
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVE-2021-3620 1 Redhat 9 Ansible Automation Platform Early Access, Ansible Engine, Enterprise Linux and 6 more 2024-02-04 2.1 LOW 5.5 MEDIUM
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
CVE-2019-11135 9 Canonical, Debian, Fedoraproject and 6 more 304 Ubuntu Linux, Debian Linux, Fedora and 301 more 2024-02-04 2.1 LOW 6.5 MEDIUM
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
CVE-2019-10194 2 Ovirt, Redhat 2 Ovirt, Virtualization Manager 2024-02-04 2.1 LOW 5.5 MEDIUM
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.
CVE-2019-10744 5 F5, Lodash, Netapp and 2 more 21 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 18 more 2024-02-04 6.4 MEDIUM 9.1 CRITICAL
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVE-2018-16881 2 Redhat, Rsyslog 5 Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation and 2 more 2024-02-04 5.0 MEDIUM 7.5 HIGH
A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.
CVE-2019-8331 4 F5, Getbootstrap, Redhat and 1 more 16 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 13 more 2024-02-04 4.3 MEDIUM 6.1 MEDIUM
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
CVE-2018-17958 4 Canonical, Debian, Qemu and 1 more 6 Ubuntu Linux, Debian Linux, Qemu and 3 more 2024-02-04 5.0 MEDIUM 7.5 HIGH
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
CVE-2018-17963 4 Canonical, Debian, Qemu and 1 more 6 Ubuntu Linux, Debian Linux, Qemu and 3 more 2024-02-04 7.5 HIGH 9.8 CRITICAL
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CVE-2017-7481 3 Canonical, Debian, Redhat 10 Ubuntu Linux, Debian Linux, Ansible Engine and 7 more 2024-02-04 7.5 HIGH 9.8 CRITICAL
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.