WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product virtualization manager✕
Overview 18 matches · 1 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
18matches 1in Waratek scope5.6% 0protected0.0% 2exploited11.1% 0CISA KEV0.0% 2public PoC11.1% 2EPSS ≥ 0.511.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 5.6% Outside Waratek scope 2 11.1% Not applicable 15 83.3% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 18 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 18 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 11.1% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 16 88.9%
split by peak 5 / year
Not applicable: 15Outside Waratek scope: 2No exploit published: 1 Medium: 18 not blocked: 18 No public exploit: 16Exploited: 2
20101 Not applicable1 Medium1 not blocked1 No public exploit1 20110 20120 20134 Not applicable4 Medium4 not blocked4 No public exploit4 20142 Not applicable2 Medium2 not blocked2 No public exploit2 20151 Not applicable1 Medium1 not blocked1 No public exploit1 20161 Not applicable1 Medium1 not blocked1 No public exploit1 20171 Not applicable1 Medium1 not blocked1 No public exploit1 20182 Outside Waratek scope1 Not applicable1 Medium2 not blocked2 Exploited1 No public exploit1 20195 No exploit published1 Outside Waratek scope1 Not applicable3 Medium5 not blocked5 Exploited1 No public exploit4 20200 20210 20221 Not applicable1 Medium1 not blocked1 No public exploit1
2010201220142016201820202022
18 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-3620 Medium 2022-03-03 Not applicable No public exploit A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
CVE-2019-11135 Medium 2019-11-14 Not applicable No public exploit TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
CVE-2013-0186 Medium 2019-11-01 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2019-10194 Medium 2019-07-11 No exploit published No public exploit Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.
CVE-2019-11358 Medium 2019-04-20 Outside Waratek scope Exploited jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVE-2019-8331 Medium 2019-02-20 Not applicable No public exploit In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
CVE-2018-3639 Medium 2018-05-22 Outside Waratek scope Exploited Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.
CVE-2018-1059 Medium 2018-04-24 Not applicable No public exploit The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
CVE-2015-5293 Medium 2017-08-24 Not applicable No public exploit Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None, which might allow remote attackers to communicate with a system designated to be unreachable.
CVE-2016-5709 Medium 2016-06-24 Not applicable No public exploit SolarWinds Virtualization Manager 6.3.1 and earlier uses weak encryption to store passwords in /etc/shadow, which allows local users with superuser privileges to obtain user passwords via a brute force attack.
CVE-2015-0237 Medium 2015-05-01 Not applicable No public exploit Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.
CVE-2014-3573 Medium 2014-10-18 Not applicable No public exploit The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML External Entity (XXE) issue.
CVE-2013-6434 Medium 2014-01-24 Not applicable No public exploit The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.
CVE-2013-2144 Medium 2013-07-03 Not applicable No public exploit Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.
CVE-2013-0168 Medium 2013-03-12 Not applicable No public exploit The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.
CVE-2012-0861 Medium 2013-01-04 Not applicable No public exploit The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.
CVE-2012-0860 Medium 2013-01-04 Not applicable No public exploit Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vds_bootstrap.py Python module in /tmp/.
CVE-2010-2793 Medium 2010-12-08 Not applicable No public exploit Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors involving knowledge of the name of this named pipe, in conjunction with use of the ImpersonateNamedPipeClient function.