CVE-2019-10194

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Red Hat	ovirt-engine-metrics	all versions

References

http://www.securityfocus.com/bid/109140Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2499Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10194Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/109140Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2499Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10194Issue Tracking, Vendor Advisory

Timeline

Published: Jul 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101956.5A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way th CVE-2019-101969.8A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constru CVE-2019-101979.1A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters w CVE-2019-101986.5An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_re CVE-2019-101998.8It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use th CVE-2019-102007.2A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedul CVE-2019-10200017.5yard before 0.9.20 allows path traversal.CVE-2019-10200027.5Pterodactyl before 0.7.14 with 2FA allows credential sniffing.CVE-2019-10200035.4invenio-records before 1.2.2 allows XSS.CVE-2019-10200047.5Tridactyl before 1.16.0 allows fake key events.CVE-2019-10200055.4invenio-communities before 1.0.0a20 allows XSS.CVE-2019-10200066.1invenio-app before 1.1.1 allows host header injection.