CVE-2015-1195

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.

• CWE-22

• http://lists.openstack.org/pipermail/openstack-announce/2015-January/000325.htmlVendor Advisory
• http://secunia.com/advisories/62169Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/01/15/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/01/18/5Mailing List, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlThird Party Advisory
• http://www.securityfocus.com/bid/71976Third Party Advisory, VDB Entry
• https://bugs.launchpad.net/ossa/+bug/1408663Third Party Advisory
• http://lists.openstack.org/pipermail/openstack-announce/2015-January/000325.htmlVendor Advisory
• http://secunia.com/advisories/62169Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/01/15/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/01/18/5Mailing List, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlThird Party Advisory
• http://www.securityfocus.com/bid/71976Third Party Advisory, VDB Entry
• https://bugs.launchpad.net/ossa/+bug/1408663Third Party Advisory

Published

Jan 21, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1187The ping tool in multiple D-Link and TRENDnet devices allow …9.8
• CVE-2015-1188The certificate verification functions in the HNDS service i…
• CVE-2015-1191Multiple directory traversal vulnerabilities in pigz 2.3.1 a…
• CVE-2015-1192Absolute path traversal vulnerability in kgb 1.0b4 allows re…
• CVE-2015-1193Multiple directory traversal vulnerabilities in pax 1:201407…
• CVE-2015-1194pax 1:20140703 allows remote attackers to write to arbitrary…
• CVE-2015-1196GNU patch 2.7.1 allows remote attackers to write to arbitrar…
• CVE-2015-1197cpio 2.11, when using the --no-absolute-filenames option, al…
• CVE-2015-1198Multiple directory traversal vulnerabilities in ha 0.999p+df…
• CVE-2015-1199Directory traversal vulnerability in ppmd 10.1-5.
• CVE-2015-1200Race condition in pxz 4.999.99 Beta 3 uses weak file permiss…
• CVE-2015-1201Privoxy before 3.0.22 allows remote attackers to cause a den…