Horizon

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

Published: 2026-06-17T14:12:20.715Z
Updated: 2026-06-17T15:40:12.791Z

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix.

Published: 2026-05-05T00:00:00.000Z
Updated: 2026-05-06T06:05:23.992Z

Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.

Published: 2023-08-22T00:00:00.000Z
Updated: 2024-08-03T14:17:03.817Z

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.

Published: 2020-12-04T07:06:03.000Z
Updated: 2024-08-04T16:55:10.412Z

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Published: 2016-07-12T19:00:00.000Z
Updated: 2024-08-06T00:32:24.621Z