An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer visible. The highest threat from this vulnerability is on confidentiality.

An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer visible. The highest threat from this vulnerability is on confidentiality.

novnc: XSS vulnerability via the messages propagated to the status field bootstrap: XSS in the tooltip or popover data-template attribute libquartz: XXE attacks via job description ovirt-engine: response_type parameter allows reflected XSS nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload ovirt-engine: Redirect to arbitrary URL allows for phishing jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods