Index
Bugtraq
Pełna lista
Błędy
Sztuczki
Exploity
Dorks list
Tylko z CVE
Tylko z CWE
Bogus
Ranking
CVEMAP
Świeża lista CVE
Producenci
Produkty
Słownik CWE
Sprawdź nr. CVE
Sprawdź nr. CWE
Szukaj
W Bugtraq
W bazie CVE
Po autorze
Po nr. CVE
Po nr. CWE
Po producencie
Po produkcie
RSS
Bugtraq
CVEMAP
CVE Produkty
Tylko Błędy
Tylko Exploity
Tylko Dorks
Więcej
cIFrex
Facebook
Twitter
Donate
O bazie
Lang
Polish
English
Submit
Podatności dla
'HEAT'
2018-07-27
CVE-2017-2621
CWE-532
An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information.
2016-11-04
CVE-2016-9185
CWE-200
In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.
2016-01-20
CVE-2015-5295
The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.
2014-05-23
CVE-2014-3801
CWE-200
OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.
2013-12-14
CVE-2013-6428
CWE-264
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
CVE-2013-6426
CWE-264
The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.
>>>
Vendor:
Openstack
55
Produkty
Compute
Essex
NOVA
Horizon
Diablo
Folsom
Keystone
Swift
Glance
Grizzly
Cinder folsom
Compute (nova) essex
Compute (nova) folsom
Keystone essex
Devstack
Havana
Python glanceclient
Python-keystoneclient
Image registry and delivery service (glance)
Ceilometer
HEAT
OSLO
Icehouse
Neutron
JUNO
Pycadf
Telemetry (ceilometer)
Keystonemiddleware
Cinder
Trove
Compute (nova)
KILO
Ironic inspector
Swift3
Tripleo heat templates
Mitaka-murano
Murano
Murano-dashboard
Python-muranoclient
Puppet-gerrit
Nova-lxd
Manila
Ironic
Cloud magnum orchestration
Openstack
Designate
Instack-undercloud
Swauth
Puppet-tripleo
Oslo.middleware
Tripleo-common
Magnum
Ironic-inspector
Os-vif
Puppet-swift
Copyright
2024
, cxsecurity.com
Back to Top