CVE-2018-1075

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.

• CWE-532
• CWE-522
• CWE-532

• https://access.redhat.com/errata/RHSA-2018:2071Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1075Issue Tracking, Third Party Advisory
• https://gerrit.ovirt.org/#/c/91653/Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2071Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1075Issue Tracking, Third Party Advisory
• https://gerrit.ovirt.org/#/c/91653/Vendor Advisory

Published

Jun 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1074ovirt-engine API and administration web portal before versio…7.7
• CVE-2018-10740Axublog 1.1.0 allows remote Code Execution as demonstrated b…
• CVE-2018-10746An issue was discovered on D-Link DSL-3782 EU 1.01 devices. …
• CVE-2018-10747An issue was discovered on D-Link DSL-3782 EU 1.01 devices. …
• CVE-2018-10748An issue was discovered on D-Link DSL-3782 EU 1.01 devices. …
• CVE-2018-10749An issue was discovered on D-Link DSL-3782 EU 1.01 devices. …
• CVE-2018-10750An issue was discovered on D-Link DSL-3782 EU 1.01 devices. …
• CVE-2018-10751A malformed OMACP WAP push message can cause memory corrupti…
• CVE-2018-10752The Tagregator plugin 0.6 for WordPress has stored XSS via t…
• CVE-2018-10753Stack-based buffer overflow in the delayed_output function i…9.8
• CVE-2018-10754Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-10755Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…