CVE-2014-0154

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2015-0158.htmlPatch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1077450Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0158.htmlPatch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1077450Vendor Advisory

Timeline

Published: Feb 13, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01555.5The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic CVE-2014-01569.8Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argument CVE-2014-01574.3Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 CVE-2014-01588.8Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service CVE-2014-01595.0Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial o CVE-2014-01607.5The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows rem CVE-2014-01615.9ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or CVE-2014-01626.0The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allow CVE-2014-01638.8Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.CVE-2014-01642.1openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective c CVE-2014-01654.0WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related CVE-2014-01666.4The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determi