Red Hat Virtualization Manager vulnerabilities

13 CVEs affecting Red Hat Virtualization Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-3620, published 2022-03-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2018-3639, published 2018-05-22. Medium severity, CVSS 5.5. EPSS: 60.6% chance of exploitation in the next 30 days. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of…
CVE-2019-8331, published 2019-02-20. Medium severity, CVSS 6.1. EPSS: 16.4% chance of exploitation in the next 30 days. In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
CVE-2018-17958, published 2018-10-09. High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days. Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
CVE-2019-10744, published 2019-07-26. Critical severity, CVSS 9.1. EPSS: 5% chance of exploitation in the next 30 days. Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor…
CVE-2017-7481, published 2018-07-19. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be…
CVE-2018-17963, published 2018-10-09. Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days. qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CVE-2019-11135, published 2019-11-14. Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days. TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
CVE-2017-9214, published 2017-05-23. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function…
CVE-2018-16881, published 2019-01-25. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions…

Latest

CVE-2021-3620, published 2022-03-03. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest…
CVE-2019-10194, published 2019-07-11. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run…