Virtualization Manager
Vendor:
First CVE: May 23, 2017 · Active for 9 years
13
Total CVEs
More Total CVEs than 91% of tracked products
3.3
Avg CVEs / Year
Higher CVE frequency than 81% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 46% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Virtualization Manager over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 23, 2017
9 years ago
Most Recent CVE
Mar 3, 2022
1,604 days ago
CVE Severity & Scoring
Virtualization Manager13 CVEs
54%
15%
31%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local4 (30.8%)
Network8 (61.5%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network1 (7.7%)
Attack Complexity
Low12 (92.3%)
High1 (7.7%)
Unknown0 (0.0%)
User Interaction
None11 (84.6%)
Unknown0 (0.0%)
Required2 (15.4%)
Privileges Required
Low4 (30.8%)
High0 (0.0%)
None9 (69.2%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-11358MEDIUM jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob | Apr 20, 2019 | 6.1 | 78 | NO | YES |
CVE-2018-3639MEDIUM Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthori | May 22, 2018 | 5.5 | 65 | NO | YES |
CVE-2018-17963CRITICAL qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impac | Oct 9, 2018 | 9.8 | 33 | NO | NO |
CVE-2017-7481CRITICAL Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Un | Jul 19, 2018 | 9.8 | 33 | NO | NO |
CVE-2017-9214CRITICAL In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the f | May 23, 2017 | 9.8 | 32 | NO | NO |
CVE-2019-10744CRITICAL Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype usin | Jul 26, 2019 | 9.1 | 31 | NO | NO |
CVE-2019-8331MEDIUM In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. | Feb 20, 2019 | 6.1 | 27 | NO | NO |
CVE-2018-17958HIGH Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used. | Oct 9, 2018 | 7.5 | 27 | NO | NO |
CVE-2019-11135MEDIUM TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with l | Nov 14, 2019 | 6.5 | 26 | NO | NO |
CVE-2018-16881HIGH A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to c | Jan 25, 2019 | 7.5 | 26 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (13 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
15.4% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (13 CVEs).
Media Mentions
Signals from CVEs in this product scope (13 CVEs).
Top CNAs Publishing CVEs For Virtualization Manager
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.4 | 1 | 5.5 | 0.4% | 0 | 0 |
| 4.3 | 8 | 7.1 | 22.9% | 0 | 2 |
| 4.2 | 2 | 6.0 | 31.9% | 0 | 1 |
| 4.1 | 3 | 8.6 | 2.9% | 0 | 0 |