| CVE-2025-66171 |
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0
|
Non notée
|
8 mai 2026 |
| CVE-2025-66170 |
The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0
|
Non notée
|
8 mai 2026 |
| CVE-2025-59302 |
Apache CloudStack: Potential remote code execution on Javascript engine defined rules
|
Non notée
|
27 nov. 2025 |
| CVE-2025-59454 |
In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs -…
|
Non notée
|
27 nov. 2025 |
| CVE-2025-30675 |
In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs
|
4.7
Moyenne
|
10 juin 2025 |
| CVE-2025-22829 |
The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0
|
2.3
Faible
|
10 juin 2025 |
| CVE-2025-26521 |
When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret…
|
Non notée
|
10 juin 2025 |
| CVE-2025-47849 |
A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious…
|
Non notée
|
10 juin 2025 |
| CVE-2025-47713 |
A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious…
|
Non notée
|
10 juin 2025 |
| CVE-2025-22828 |
CloudStack users can add and read comments (annotations) on resources they are authorised to access. Due to an access…
|
Non notée
|
13 janv. 2025 |
| CVE-2024-50386 |
Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary…
|
8.5
Élevée
|
12 nov. 2024 |
| CVE-2024-45219 |
Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and…
|
8.5
Élevée
|
16 oct. 2024 |
| CVE-2024-45462 |
The logout operation in the CloudStack web interface does not expire the user session completely which is valid until…
|
6.3
Moyenne
|
16 oct. 2024 |
| CVE-2024-45693 |
Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to…
|
8.0
Élevée
|
16 oct. 2024 |
| CVE-2024-42062 |
CloudStack account-users by default use username and password based authentication for API and UI access
|
Non notée
|
7 août 2024 |
| CVE-2024-42222 |
In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network…
|
Non notée
|
7 août 2024 |
| CVE-2024-41107 |
The CloudStack SAML authentication (disabled by default) does not enforce signature check
|
Non notée
|
19 juil. 2024 |
| CVE-2024-38346 |
The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands…
|
Non notée
|
5 juil. 2024 |
| CVE-2024-39864 |
The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when…
|
Non notée
|
5 juil. 2024 |
| CVE-2024-29008 |
A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused…
|
Non notée
|
4 avr. 2024 |
| CVE-2024-29007 |
The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or…
|
Non notée
|
4 avr. 2024 |
| CVE-2024-29006 |
By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an…
|
Non notée
|
4 avr. 2024 |
| CVE-2022-35741 |
Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be…
|
Non notée
|
18 juil. 2022 |
| CVE-2022-26779 |
Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens
|
Non notée
|
15 mars 2022 |
| CVE-2013-4317 |
In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular,…
|
Non notée
|
6 févr. 2018 |