Summary
| Detail | |||
|---|---|---|---|
| Vendor | Openstack | First view | 2013-11-23 |
| Product | Horizon | Last view | 2023-08-22 |
| Version | 10.0.0 | Type | Application |
| Update | b2 | ||
| Edition | * | ||
| Language | * | ||
| Sofware Edition | * | ||
| Target Software | * | ||
| Target Hardware | * | ||
| Other | * | ||
| CPE Product | cpe:2.3:a:openstack:horizon | ||
Activity : Overall
Related : CVE
| Date | Alert | Description | |
|---|---|---|---|
| 6.1 | 2023-08-22 | CVE-2022-45582 | Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter. |
| 6.1 | 2020-12-04 | CVE-2020-29565 | An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL. |
| 5.5 | 2019-12-30 | CVE-2012-5474 | The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value. |
| 4.8 | 2017-04-03 | CVE-2017-7400 | OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping. |
| 5 | 2014-12-12 | CVE-2014-8124 | OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page. |
| 3.5 | 2014-10-31 | CVE-2014-8578 | Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475. |
| 3.5 | 2014-10-31 | CVE-2014-3475 | Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578. |
| 3.5 | 2014-10-31 | CVE-2014-3474 | Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name. |
| 4.3 | 2014-10-31 | CVE-2014-3473 | Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template. |
| 3.5 | 2014-08-22 | CVE-2014-3594 | Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name. |
| 5.5 | 2014-05-14 | CVE-2013-4471 | The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user. |
| 4.3 | 2013-11-23 | CVE-2013-6858 | Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topology" page. |
CWE : Common Weakness Enumeration
| % | id | Name |
|---|---|---|
| 58% (7) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
| 16% (2) | CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') |
| 8% (1) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
| 8% (1) | CWE-311 | Missing Encryption of Sensitive Data |
| 8% (1) | CWE-287 | Improper Authentication |
Nessus® Vulnerability Scanner
| id | Description |
|---|---|
| 2015-01-20 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2015-39.nasl - Type: ACT_GATHER_INFO |
| 2015-01-19 | Name: The remote Solaris system is missing a security patch for third-party software. File: solaris11_horizon_20140819.nasl - Type: ACT_GATHER_INFO |
| 2015-01-19 | Name: The remote Solaris system is missing a security patch for third-party software. File: solaris11_horizon_20140915.nasl - Type: ACT_GATHER_INFO |
| 2015-01-06 | Name: The remote Fedora host is missing a security update. File: fedora_2014-17177.nasl - Type: ACT_GATHER_INFO |
| 2014-09-10 | Name: The remote Fedora host is missing a security update. File: fedora_2014-9791.nasl - Type: ACT_GATHER_INFO |
| 2014-08-22 | Name: The remote Ubuntu host is missing a security-related patch. File: ubuntu_USN-2323-1.nasl - Type: ACT_GATHER_INFO |
| 2013-12-20 | Name: The remote Ubuntu host is missing a security-related patch. File: ubuntu_USN-2062-1.nasl - Type: ACT_GATHER_INFO |
| 2012-11-26 | Name: The remote Fedora host is missing a security update. File: fedora_2012-18185.nasl - Type: ACT_GATHER_INFO |
