Red Hat Enterprise Virtualization Manager vulnerabilities

19 CVEs affecting Red Hat Enterprise Virtualization Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2009-3552, published 2019-11-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-8897, published 2018-05-08. High severity, CVSS 7.8. EPSS: 18.5% chance of exploitation in the next 30 days. A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels,…
CVE-2015-7544, published 2017-09-25. Critical severity, CVSS 9.1. EPSS: 3.4% chance of exploitation in the next 30 days. redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary…
CVE-2013-0168, published 2013-03-12. Medium severity, CVSS 4.0. EPSS: 1.9% chance of exploitation in the next 30 days. The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to…
CVE-2015-5293, published 2017-08-24. Medium severity, CVSS 5.9. EPSS: 1.9% chance of exploitation in the next 30 days. Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None, which might allow remote attackers to communicate with a…
CVE-2014-3573, published 2014-10-18. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or…
CVE-2015-0237, published 2015-05-01. Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days. Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users…
CVE-2013-2144, published 2013-07-03. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space…
CVE-2010-2793, published 2010-12-08. Medium severity, CVSS 6.8. EPSS: 1% chance of exploitation in the next 30 days. Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe, and…
CVE-2018-1072, published 2018-06-26. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and…
CVE-2013-6434, published 2014-01-24. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which…

Latest

CVE-2009-3552, published 2019-11-09. Low severity, CVSS 3.1. EPSS: 0.4% chance of exploitation in the next 30 days. In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF)…
CVE-2015-0257, published 2015-05-01. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup, which allows local…