Proxmox security advisories
Every advisory Proxmox has published in the forum, with packages, fixed versions and CVSS scores.
71 advisories
RSS feed
- Missing privilege checks when removing namespace from prune job
proxmox-backup-server
–No score - S3-Refresh path escape issue
proxmox-backup-server
–No score - Missing privilege checks for local sync jobs
proxmox-backup-server
–No score - Missing privilege checks in GC status API
proxmox-backup-server
–No score - Incomplete validation of sync encryption/decryption key access
proxmox-backup-server
–No score - Out-of-bounds read when processing malformed fixed-size index file
proxmox-backup-server
–No score - pxar/container restore target rootfs escape
pve-container, proxmox-backup-client, rust-pxar
–No score - PBS backup access includes host/NNN groups
libpve-storage-perl
–No score - Command injection via import of malicious OVA file
libpve-storage-perl, qemu-server
–No score - integrity bypass of encrypted backups on an untrusted PBS instance
proxmox-backup-client, proxmox-backup-file-restore, libproxmox-backup-qemu0
–No score - PMG: Bypass of mail filters by crafted boundary parameters
pmg-api, libmime-tools-perl
–No score - –No score
- password change via incomplete username validation
pve-access-control
–No score - newline injection into firewall config files
pve-firewall, proxmox-firewall
–No score - ACME directory ToS URL XSS
proxmox-backup, proxmox-widget-toolkit
–No score - –No score
- XSS in various UI components
pve-manager
–No score - Authentication bypass in EOL Proxmox VE 7 release
libpve-access-control Affected: libpve-access-control >= 7.0-7 and < 8.0.4 Roughly corresponding to Proxmox VE 7.0 up t…
CVE-2023-54391
9.8Critical - –No score
- missing filename reference validation in backup manifests
proxmox-backup-server
–No score - incomplete privilege checks for unused volumes
qemu-server, pve-container
–No score - –No score
- –No score
- 9.8Critical
- –No score