CVE Browser

Apache CloudStack: DoS caused by database connections leak

Apache CloudStack: OS Command Injection due to unsanitized mount command

Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

Apache CloudStack: Improper access control in Userdata reference APIs

Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module

Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure

Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob

Apache CloudStack: LDAP provider configuration disclosure

Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

Apache CloudStack: OAuth2 Token Cross-Request Leak

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI

Apache CloudStack: Get and Run Diagnostics Command Injection

Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

Apache CloudStack: Webhook Deliveries Incorrect Access

Apache CloudStack: Authorization issue with listHostTags for domain admins

Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue

Apache CloudStack: Unauthorised comment creation and disclosure

Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP

Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access

Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates

Apache CloudStack: Domain/account resources limits not honored

Apache CloudStack: MinIO policy remains intact on bucket deletion

Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to