Openstack

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2013-4354 1Openstack 1Image Registry And Delivery Service (glance) Apr 29, 2026 Nov 23, 2013 N/A· v4 N/A· v3 2.1 LOW· v2 The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary tenants by adding the tenant as a member of the image.
CVE-2013-4497 1Openstack 3Folsom GrizzlyHavana Apr 29, 2026 Nov 5, 2013 N/A· v4 N/A· v3 6.4 MEDIUM· v2 The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to b...Show more The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.Show less
CVE-2013-4477 1Openstack 2Grizzly Havana Apr 29, 2026 Nov 2, 2013 N/A· v4 N/A· v3 3.3 LOW· v2 The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
CVE-2013-4469 1Openstack 3Folsom GrizzlyHavana Apr 29, 2026 Nov 2, 2013 N/A· v4 N/A· v3 1.9 LOW· v2 OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk c...Show more OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.Show less
CVE-2013-4261 2Openstack Redhat 3Folsom GrizzlyOpenstack Apr 29, 2026 Oct 29, 2013 N/A· v4 N/A· v3 3.5 LOW· v2 OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (...Show more OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.Show less
CVE-2013-4185 2Openstack Redhat 2Compute Openstack Apr 29, 2026 Oct 29, 2013 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users t...Show more Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests.Show less
CVE-2013-4428 2Canonical Openstack 2Glance Ubuntu Linux Apr 29, 2026 Oct 27, 2013 N/A· v4 N/A· v3 3.5 LOW· v2 OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which al...Show more OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.Show less
CVE-2013-2013 1Openstack 1Python Keystoneclient Apr 29, 2026 Oct 1, 2013 N/A· v4 N/A· v3 2.1 LOW· v2 The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.
CVE-2013-4222 4Canonical FedoraprojectOpenstack+1 more 4Fedora KeystoneOpenstack+1 more Apr 29, 2026 Sep 30, 2013 N/A· v4 N/A· v3 6.5 MEDIUM· v2 OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via...Show more OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.Show less
CVE-2013-4294 1Openstack 1Keystone Apr 29, 2026 Sep 23, 2013 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers...Show more The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.Show less
CVE-2013-4278 1Openstack 1Compute Apr 29, 2026 Sep 16, 2013 N/A· v4 N/A· v3 3.5 LOW· v2 The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by...Show more The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.Show less
CVE-2013-4202 2Canonical Openstack 2Cinder Ubuntu Linux Apr 29, 2026 Sep 16, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumptio...Show more The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.Show less
CVE-2013-4183 1Openstack 1Cinder Apr 29, 2026 Sep 16, 2013 N/A· v4 N/A· v3 2.1 LOW· v2 The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspec...Show more The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.Show less
CVE-2013-4179 1Openstack 2Compute Havana Apr 29, 2026 Sep 16, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expan...Show more The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.Show less
CVE-2013-2256 1Openstack 1Nova Apr 29, 2026 Sep 16, 2013 N/A· v4 N/A· v3 6.0 MEDIUM· v2 OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor prope...Show more OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.Show less
CVE-2013-4111 2Openstack Opensuse 2Opensuse Python Glanceclient Apr 29, 2026 Aug 28, 2013 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common N...Show more The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2013-4155 1Openstack 4Folsom GrizzlyHavana+1 more Apr 29, 2026 Aug 20, 2013 N/A· v4 N/A· v3 4.0 MEDIUM· v2 OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp t...Show more OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.Show less
CVE-2013-2161 2Openstack Opensuse 4Folsom GrizzlyHavana+1 more Apr 29, 2026 Aug 20, 2013 N/A· v4 N/A· v3 7.5 HIGH· v2 XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.
CVE-2013-2157 1Openstack 1Keystone Apr 29, 2026 Aug 20, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
CVE-2013-2096 1Openstack 3Folsom GrizzlyHavana Apr 29, 2026 Jul 9, 2013 N/A· v4 N/A· v3 2.1 LOW· v2 OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with...Show more OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data.Show less

Previous 1...10 111213 14 Next