Cloudstack CVE-2012-4501

The CloudStack SAML authentication (disabled by default) does not enforce signature check. Rated high severity (CVSS 8.1

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. Rated high sev

Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allow

Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary

The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configur

The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands

By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an A

Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vul

A privilege escalation vulnerability in Apache CloudStack (CVSS 8.8) that allows the attacker. High severity vulnerabili

A privilege escalation vulnerability in Apache CloudStack (CVSS 8.8) that allows the attacker. High severity vulnerabili

Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing

Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and v