CVE-2014-8750

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-87514.3Multiple cross-site scripting (XSS) vulnerabilities in goYWP WebPress 13.00.06 allow remote attackers to inject arbitrary web script or HTMLCVE-2014-87524.3Multiple cross-site scripting (XSS) vulnerabilities in view.php in JCE-Tech PHP Video Script (aka Video Niche Script) 4.0 allow remote attacCVE-2014-87536.1Multiple cross-site scripting (XSS) vulnerabilities in Cit-e-Net Cit-e-Access 6.CVE-2014-87545.8Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbCVE-2014-87556.8Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointeCVE-2014-87566.8The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a craCVE-2014-87578.3LG On-Screen Phone (OSP) before 4.3.010 allows remote attackers to bypass authorization via a crafted request.CVE-2014-87586.1Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrarCVE-2014-87605.0ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connectionCVE-2014-87615.0inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrCVE-2014-87625.0The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in theCVE-2014-87635.0DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a pas
CVE-2014-8750: Medium severity, CVSS 6.5 | Vulnix