Heat

This hub aggregates every CVE we track for Heat, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 8 most recently published vulnerabilities affecting Heat.

• CVE-2024-7319Openstack-heat: incomplete fix for cve-2023-16255.0Aug 2, 2024
• CVE-2023-1625Information leak in api7.4Sep 24, 2023
• CVE-2017-2621An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system use...5.5Jul 27, 2018
• CVE-2016-9185In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0....4.3Nov 4, 2016
• CVE-2014-3801OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider tem...3.5May 23, 2014
• CVE-2013-6426The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance ...4.0Dec 14, 2013
• CVE-2013-6428The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified t...4.0Dec 14, 2013
• CVE-2009-3642Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.7.5Oct 9, 2009