CVE-2015-9543

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py.

• CWE-200

• http://www.openwall.com/lists/oss-security/2020/02/19/2Mailing List, Patch, Third Party Advisory
• https://launchpad.net/bugs/1492140Issue Tracking, Third Party Advisory
• https://review.opendev.org/220622Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2020-001.htmlPatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2020/02/19/2Mailing List, Patch, Third Party Advisory
• https://launchpad.net/bugs/1492140Issue Tracking, Third Party Advisory
• https://review.opendev.org/220622Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2020-001.htmlPatch, Vendor Advisory

Published

Feb 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-9537The NextGEN Gallery plugin before 2.1.10 for WordPress has m…5.4
• CVE-2015-9538The NextGEN Gallery plugin before 2.1.15 for WordPress allow…6.5
• CVE-2015-9539The Fast Secure Contact Form plugin before 4.0.38 for WordPr…6.1
• CVE-2015-9540Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url…6.1
• CVE-2015-9541Qt through 5.14 allows an exponential XML entity expansion a…7.5
• CVE-2015-9542add_password in pam_radius_auth.c in pam_radius 1.4.0 does n…7.5
• CVE-2015-9544An issue was discovered in xdLocalStorage through 2.0.5. The…7.1
• CVE-2015-9545An issue was discovered in xdLocalStorage through 2.0.5. The…7.1
• CVE-2015-9546An issue was discovered on Samsung mobile devices with KK(4.…4.8
• CVE-2015-9547An issue was discovered on Samsung mobile devices with JBP(4…7.5
• CVE-2015-9548An issue was discovered in Mattermost Server before 1.2.0. I…7.5
• CVE-2015-9549A reflected Cross-site Scripting (XSS) vulnerability exists …6.1