← Back

Openstack

openstack

266 CVEs • 65 products

Products (65)

Click to collapse
Toggle
Keystone
keystone
43 CVEs
Nova
nova
38 CVEs
Folsom
folsom
25 CVEs
Neutron
neutron
25 CVEs
Horizon
horizon
22 CVEs
Essex
essex
15 CVEs
Image Registry And Delivery Service (glance)
image_registry_and_delivery_service_(glance)
15 CVEs
Grizzly
grizzly
14 CVEs
Swift
swift
13 CVEs
Compute
compute
12 CVEs
Glance
glance
12 CVEs
Havana
havana
11 CVEs
Cinder
cinder
9 CVEs
Python Keystoneclient
python-keystoneclient
7 CVEs
Heat
heat
7 CVEs
Tripleo Heat Templates
tripleo_heat_templates
5 CVEs
Barbican
barbican
5 CVEs
Icehouse
icehouse
4 CVEs
Keystonemiddleware
keystonemiddleware
3 CVEs
Trove
trove
3 CVEs
Diablo
diablo
2 CVEs
Keystone Essex
keystone_essex
2 CVEs
Ceilometer
ceilometer
2 CVEs
Oslo
oslo
2 CVEs
Ironic Inspector
ironic_inspector
2 CVEs
Murano
murano
2 CVEs
Manila
manila
2 CVEs
Cloud Magnum Orchestration
cloud_magnum_orchestration
2 CVEs
Designate
designate
2 CVEs
Octavia
octavia
2 CVEs
Magnum
magnum
2 CVEs
Tripleo Ansible
tripleo_ansible
2 CVEs
Cinder Folsom
cinder_folsom
1 CVE
Compute (nova) Essex
compute_(nova)_essex
1 CVE
Compute (nova) Folsom
compute_(nova)_folsom
1 CVE
Devstack
devstack
1 CVE
Python Glanceclient
python_glanceclient
1 CVE
Pycadf
pycadf
1 CVE
Telemetry (ceilometer)
telemetry_(ceilometer)
1 CVE
Juno
juno
1 CVE
Kilo
kilo
1 CVE
Swift3
swift3
1 CVE
Orchestration Api
orchestration_api
1 CVE
Mitaka Murano
mitaka-murano
1 CVE
Murano Dashboard
murano-dashboard
1 CVE
Python Muranoclient
python-muranoclient
1 CVE
Compute (nova)
compute_(nova)
1 CVE
Puppet Gerrit
puppet-gerrit
1 CVE
Nova Lxd
nova-lxd
1 CVE
Ironic
ironic
1 CVE
Openstack
openstack
1 CVE
Instack Undercloud
instack-undercloud
1 CVE
Swauth
swauth
1 CVE
Puppet Tripleo
puppet-tripleo
1 CVE
Puppet Swift
puppet-swift
1 CVE
Oslo.middleware
oslo.middleware
1 CVE
Tripleo Common
tripleo-common
1 CVE
Os Vif
os-vif
1 CVE
Blazar Dashboard
blazar-dashboard
1 CVE
Oslo.utils
oslo.utils
1 CVE
Kolla
kolla
1 CVE
Glance Store
glance-store
1 CVE
Yaql
yaql
1 CVE
Vitrage
vitrage
1 CVE
Ironic Python Agent
ironic_python_agent
1 CVE

CVEs (266)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-9684
1Openstack
1Image Registry And Delivery Service (glance)
May 6, 2026
Feb 24, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large...Show more
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.Show less
CVE-2014-9623
2Openstack
Redhat
2Image Registry And Delivery Service (glance)
Openstack
May 6, 2026
Jan 23, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state.
CVE-2015-1195
1Openstack
1Image Registry And Delivery Service (glance)
May 6, 2026
Jan 21, 2015
N/A· v4
N/A· v3
6.5 MEDIUM· v2
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: U...Show more
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.Show less
CVE-2014-8153
2Litech
Openstack
2Neutron
Router Advertisement Daemon
May 6, 2026
Jan 15, 2015
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked router update processing) by creating eight routers and assigning...Show more
The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked router update processing) by creating eight routers and assigning an ipv6 non-provider subnet to each.Show less
CVE-2014-9493
2Openstack
Redhat
2Image Registry And Delivery Service (glance)
Openstack
May 6, 2026
Jan 7, 2015
N/A· v4
N/A· v3
5.5 MEDIUM· v2
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image locati...Show more
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.Show less
CVE-2014-8124
4Fedoraproject
OpenstackOpensuse+1 more
4Fedora
HorizonOpensuse+1 more
May 6, 2026
Dec 12, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service...Show more
OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.Show less
CVE-2014-7821
3Fedoraproject
OpenstackRedhat
3Fedora
NeutronOpenstack
May 6, 2026
Nov 24, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.
CVE-2014-0204
1Openstack
1Keystone
May 6, 2026
Nov 3, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a...Show more
OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.Show less
CVE-2014-8578
1Openstack
1Horizon
May 6, 2026
Oct 31, 2014
N/A· v4
N/A· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or...Show more
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.Show less
CVE-2014-3475
2Openstack
Opensuse
2Horizon
Opensuse
May 6, 2026
Oct 31, 2014
N/A· v4
N/A· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary...Show more
Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.Show less
CVE-2014-3474
2Openstack
Opensuse
2Horizon
Opensuse
May 6, 2026
Oct 31, 2014
N/A· v4
N/A· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allo...Show more
Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.Show less
CVE-2014-3473
2Openstack
Opensuse
2Horizon
Opensuse
May 6, 2026
Oct 31, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when us...Show more
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.Show less
CVE-2014-8333
2Openstack
Redhat
2Nova
Openstack
May 6, 2026
Oct 31, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state.
CVE-2014-3708
2Openstack
Redhat
2Nova
Openstack
May 6, 2026
Oct 31, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list active servers API request.
CVE-2014-3520
1Openstack
1Keystone
May 6, 2026
Oct 26, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the...Show more
OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.Show less
CVE-2014-7960
1Openstack
1Swift
May 6, 2026
Oct 17, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.
CVE-2014-8750
1Openstack
1Nova
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same V...Show more
Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances.Show less
CVE-2014-7231
2Openstack
Redhat
4Cinder
NovaOpenstack+1 more
May 6, 2026
Oct 8, 2014
N/A· v4
N/A· v3
2.1 LOW· v2
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local use...Show more
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.Show less
CVE-2014-7230
3Canonical
OpenstackRedhat
5Cinder
NovaOpenstack+2 more
May 6, 2026
Oct 8, 2014
N/A· v4
N/A· v3
2.1 LOW· v2
The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by...Show more
The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.Show less
CVE-2014-3641
1Openstack
1Cinder
May 6, 2026
Oct 8, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 h...Show more
The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.Show less