Opensuse
Page 8 of 18 — Opensuse CVEs from a corpus of 1778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18897 | High | 8.4 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE F… |
CVE-2019-3698 | Medium | 5.7 | 2020-02-28 | UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; op… |
CVE-2020-9431 | High | 7.5 | 2020-02-27 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc… |
CVE-2020-9430 | High | 7.5 | 2020-02-27 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c b… |
CVE-2020-9429 | High | 7.5 | 2020-02-27 | In Wireshark 3.2.0 to 3.2.1, the WireGuard dissector could crash. This was addressed in epan/dissectors/packet-wireguard.c by handling the situation where a ce… |
CVE-2020-9428 | High | 7.5 | 2020-02-27 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using mo… |
CVE-2020-7063 | Medium | 5.5 | 2020-02-27 | In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the file… |
CVE-2020-7062 | High | 7.5 | 2020-02-27 | In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but… |
CVE-2020-3868 | High | 8.8 | 2020-02-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5… |
CVE-2020-3867 | Medium | 6.1 | 2020-02-27 | A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows… |
CVE-2020-3865 | High | 8.8 | 2020-02-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5… |
CVE-2020-3862 | Medium | 6.5 | 2020-02-27 | A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes… |
CVE-2020-7043 | Critical | 9.1 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do… |
CVE-2020-7042 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check ope… |
CVE-2020-7041 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host neg… |
CVE-2020-9383 | High | 7.1 | 2020-02-25 | An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC… |
CVE-2020-1938 | Critical | 9.8 | 2020-02-24 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having hig… |
CVE-2020-1935 | Medium | 4.8 | 2020-02-24 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some… |
CVE-2019-17569 | Medium | 4.8 | 2020-02-24 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that… |
CVE-2020-8130 | Medium | 6.4 | 2020-02-24 | There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`. |
CVE-2020-8813 | High | 8.8 | 2020-02-22 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph… |
CVE-2020-9273 | High | 8.8 | 2020-02-20 | In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c… |
CVE-2020-9272 | High | 7.5 | 2020-02-20 | ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function. |
CVE-2019-20479 | Medium | 6.1 | 2020-02-20 | A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning. |
CVE-2020-8992 | Medium | 5.5 | 2020-02-14 | ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a cra… |
CVE-2020-0561 | High | 7.8 | 2020-02-13 | Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local acces… |
CVE-2020-8955 | Critical | 9.8 | 2020-02-12 | irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application… |
CVE-2013-2637 | Medium | 6.1 | 2020-02-12 | A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items… |
CVE-2019-19921 | High | 7.0 | 2020-02-12 | runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker… |
CVE-2020-1711 | High | 7.7 | 2020-02-11 | An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSC… |
CVE-2020-6416 | High | 8.8 | 2020-02-11 | Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2020-6415 | High | 8.8 | 2020-02-11 | Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2020-6414 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2020-6413 | High | 8.8 | 2020-02-11 | Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass HTML validators via a crafted HTML page. |
CVE-2020-6412 | Medium | 5.4 | 2020-02-11 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2020-6408 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a craft… |
CVE-2020-6404 | High | 8.8 | 2020-02-11 | Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2020-6403 | Medium | 4.3 | 2020-02-11 | Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
CVE-2020-6402 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious ext… |
CVE-2020-6401 | Medium | 6.5 | 2020-02-11 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2020-6400 | Medium | 6.5 | 2020-02-11 | Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6399 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6398 | High | 8.8 | 2020-02-11 | Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF f… |
CVE-2020-6397 | Medium | 6.5 | 2020-02-11 | Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6396 | Medium | 4.3 | 2020-02-11 | Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2020-6394 | Medium | 5.4 | 2020-02-11 | Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2020-6393 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6392 | Medium | 4.3 | 2020-02-11 | Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-6391 | Medium | 4.3 | 2020-02-11 | Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a cra… |
CVE-2020-6390 | High | 8.8 | 2020-02-11 | Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-6385 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2020-6382 | High | 8.8 | 2020-02-11 | Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6381 | High | 8.8 | 2020-02-11 | Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption… |
CVE-2018-14553 | High | 7.5 | 2020-02-11 | gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call se… |
CVE-2020-7217 | High | 7.5 | 2020-02-11 | An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 p… |
CVE-2020-7060 | Medium | 6.5 | 2020-02-10 | When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possib… |
CVE-2020-7059 | Medium | 6.5 | 2020-02-10 | When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to s… |
CVE-2020-1700 | Medium | 6.5 | 2020-02-07 | A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disco… |
CVE-2019-15606 | Critical | 9.8 | 2020-02-07 | Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons |
CVE-2019-15605 | Critical | 9.8 | 2020-02-07 | HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed |
CVE-2019-15604 | High | 7.5 | 2020-02-07 | Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate |
CVE-2020-8608 | Medium | 5.6 | 2020-02-06 | In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. |
CVE-2014-2030 | High | 8.8 | 2020-02-06 | Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of servic… |
CVE-2014-1958 | High | 8.8 | 2020-02-06 | Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a craf… |
CVE-2020-8649 | Medium | 5.9 | 2020-02-06 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. |
CVE-2020-8648 | High | 7.1 | 2020-02-06 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c. |
CVE-2020-8647 | Medium | 6.1 | 2020-02-06 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c. |
CVE-2020-7216 | High | 7.5 | 2020-02-05 | An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets wit… |
CVE-2020-8632 | Medium | 5.5 | 2020-02-05 | In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to… |
CVE-2020-8631 | Medium | 5.5 | 2020-02-05 | cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudin… |
CVE-2020-5208 | High | 7.7 | 2020-02-05 | It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffe… |
CVE-2019-12528 | High | 7.5 | 2020-02-04 | An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as informati… |
CVE-2020-8517 | High | 7.5 | 2020-02-04 | An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to me… |
CVE-2020-8450 | High | 7.3 | 2020-02-04 | An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a r… |
CVE-2020-8449 | High | 7.5 | 2020-02-04 | An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server res… |
CVE-2020-8118 | Medium | 5.0 | 2020-02-04 | An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calen… |
CVE-2019-15624 | Medium | 4.9 | 2020-02-04 | Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders. |
CVE-2019-15623 | Medium | 5.3 | 2020-02-04 | Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any furthe… |
CVE-2019-15613 | High | 8.0 | 2020-02-04 | A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes. |
CVE-2019-20446 | Medium | 6.5 | 2020-02-02 | In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The at… |
CVE-2013-3565 | Medium | 6.1 | 2020-01-31 | Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary… |
CVE-2020-8492 | Medium | 6.5 | 2020-01-30 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression… |
CVE-2020-8432 | Critical | 9.8 | 2020-01-29 | In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where co… |
CVE-2020-0549 | Medium | 5.5 | 2020-01-28 | Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local… |
CVE-2006-7246 | Medium | 6.8 | 2020-01-27 | NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used. |
CVE-2018-20105 | Medium | 4.0 | 2020-01-27 | A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn… |
CVE-2018-12476 | Medium | 4.3 | 2020-01-27 | Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a r… |
CVE-2019-1353 | Critical | 9.8 | 2020-01-24 | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the… |
CVE-2019-1348 | Low | 3.3 | 2020-01-24 | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks opti… |
CVE-2019-1351 | High | 7.5 | 2020-01-24 | A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'. |
CVE-2019-18900 | Medium | 4.0 | 2020-01-24 | : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed lo… |
CVE-2019-3700 | Low | 2.9 | 2020-01-24 | yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were move… |
CVE-2019-3699 | High | 7.7 | 2020-01-24 | UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user pr… |
CVE-2019-3697 | High | 7.7 | 2020-01-24 | UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to… |
CVE-2019-3694 | High | 7.7 | 2020-01-24 | A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin t… |
CVE-2019-3693 | High | 7.7 | 2020-01-24 | A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed l… |
CVE-2019-3692 | High | 7.7 | 2020-01-24 | The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attac… |
CVE-2015-5333 | High | 7.5 | 2020-01-23 | Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number o… |
CVE-2015-5334 | Critical | 9.8 | 2020-01-23 | Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute… |
CVE-2019-3691 | High | 7.7 | 2020-01-23 | A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to esc… |