SUSE
Page 3 of 14 — SUSE CVEs from a corpus of 1309, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6422 | High | 8.8 | 2020-03-23 | Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-10803 | Medium | 5.4 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack t… |
CVE-2020-10802 | High | 8.0 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when g… |
CVE-2020-10804 | High | 8.0 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/… |
CVE-2019-3696 | High | 8.4 | 2020-03-03 | A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPO… |
CVE-2019-3695 | High | 8.4 | 2020-03-03 | A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterpr… |
CVE-2020-8013 | Low | 2.2 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Se… |
CVE-2019-18903 | High | 7.5 | 2020-03-02 | A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attacke… |
CVE-2019-18902 | High | 7.5 | 2020-03-02 | A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attacke… |
CVE-2019-18901 | Medium | 5.1 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Ente… |
CVE-2019-18897 | High | 8.4 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE F… |
CVE-2019-3698 | Medium | 5.7 | 2020-02-28 | UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; op… |
CVE-2014-1947 | High | 7.8 | 2020-02-17 | Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service… |
CVE-2020-6416 | High | 8.8 | 2020-02-11 | Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2020-6415 | High | 8.8 | 2020-02-11 | Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2020-6408 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a craft… |
CVE-2020-6406 | High | 8.8 | 2020-02-11 | Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6404 | High | 8.8 | 2020-02-11 | Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2020-6403 | Medium | 4.3 | 2020-02-11 | Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
CVE-2020-6402 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious ext… |
CVE-2020-6400 | Medium | 6.5 | 2020-02-11 | Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6398 | High | 8.8 | 2020-02-11 | Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF f… |
CVE-2020-6397 | Medium | 6.5 | 2020-02-11 | Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6396 | Medium | 4.3 | 2020-02-11 | Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2020-6394 | Medium | 5.4 | 2020-02-11 | Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2020-6393 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6392 | Medium | 4.3 | 2020-02-11 | Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-6391 | Medium | 4.3 | 2020-02-11 | Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a cra… |
CVE-2020-6390 | High | 8.8 | 2020-02-11 | Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-6385 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2020-6382 | High | 8.8 | 2020-02-11 | Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6381 | High | 8.8 | 2020-02-11 | Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption… |
CVE-2019-15624 | Medium | 4.9 | 2020-02-04 | Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders. |
CVE-2019-15623 | Medium | 5.3 | 2020-02-04 | Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any furthe… |
CVE-2006-7246 | Medium | 6.8 | 2020-01-27 | NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used. |
CVE-2017-14807 | High | 8.1 | 2020-01-27 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susestudio-ui-server of SUSE Studio onsite allows remo… |
CVE-2017-14806 | Low | 3.7 | 2020-01-27 | A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, whi… |
CVE-2018-20105 | Medium | 4.0 | 2020-01-27 | A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn… |
CVE-2018-12476 | Medium | 4.3 | 2020-01-27 | Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a r… |
CVE-2019-18900 | Medium | 4.0 | 2020-01-24 | : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed lo… |
CVE-2019-3700 | Low | 2.9 | 2020-01-24 | yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were move… |
CVE-2019-3694 | High | 7.7 | 2020-01-24 | A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin t… |
CVE-2019-3693 | High | 7.7 | 2020-01-24 | A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed l… |
CVE-2019-3692 | High | 7.7 | 2020-01-24 | The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attac… |
CVE-2019-3687 | Medium | 4.0 | 2020-01-24 | The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This… |
CVE-2015-5239 | Medium | 6.5 | 2020-01-23 | Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, wh… |
CVE-2019-3691 | High | 7.7 | 2020-01-23 | A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to esc… |
CVE-2019-18898 | High | 7.7 | 2020-01-23 | UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers e… |
CVE-2019-3686 | Medium | 6.5 | 2020-01-17 | openQA before commit c172e8883d8f32fced5e02f9b6faaacc913df27b was vulnerable to XSS in the distri and version parameter. This was reported through the bug boun… |
CVE-2019-3683 | High | 8.8 | 2020-01-17 | The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/us… |
CVE-2019-3682 | High | 8.4 | 2020-01-17 | The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node. |
CVE-2020-7106 | Medium | 6.1 | 2020-01-16 | Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_a… |
CVE-2020-5504 | High | 8.8 | 2020-01-09 | In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own… |
CVE-2010-3782 | High | 8.8 | 2020-01-02 | obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation. |
CVE-2019-19925 | High | 7.5 | 2019-12-24 | zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. |
CVE-2019-19923 | High | 7.5 | 2019-12-24 | flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can… |
CVE-2019-19926 | High | 7.5 | 2019-12-23 | multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vuln… |
CVE-2019-19880 | High | 7.5 | 2019-12-18 | exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses… |
CVE-2019-13764 | High | 8.8 | 2019-12-10 | Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13745 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13734 | High | 8.8 | 2019-12-10 | Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-3690 | Medium | 6.8 | 2019-12-05 | The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenin… |
CVE-2019-10220 | High | 8.8 | 2019-11-27 | Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists. |
CVE-2012-6639 | High | 8.8 | 2019-11-25 | An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data. |
CVE-2016-5285 | High | 7.5 | 2019-11-15 | A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMAC… |
CVE-2019-3688 | Medium | 5.1 | 2019-10-07 | The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 1… |
CVE-2019-3689 | Medium | 5.1 | 2019-09-19 | The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including… |
CVE-2019-13209 | Medium | 6.1 | 2019-09-04 | Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The at… |
CVE-2019-11202 | Critical | 9.8 | 2019-07-30 | An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher s… |
CVE-2019-11730 | Medium | 6.5 | 2019-07-23 | A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directo… |
CVE-2019-11709 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory c… |
CVE-2019-11038 | Medium | 5.3 | 2019-06-19 | When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30… |
CVE-2019-11881 | Medium | 4.7 | 2019-06-10 | A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tag… |
CVE-2019-12303 | High | 8.8 | 2019-06-06 | In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container. |
CVE-2019-12274 | High | 8.8 | 2019-06-06 | In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver opt… |
CVE-2019-5798 | Medium | 6.5 | 2019-05-23 | Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted… |
CVE-2019-3684 | Medium | 5.9 | 2019-05-13 | SUSE Manager until version 4.0.7 and Uyuni until commit 1b426ad5ed0a7191a6fb46bb83e98ae4b99a5ade created world-readable swap files on systems that don't have a… |
CVE-2019-7443 | High | 8.1 | 2019-05-07 | KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cau… |
CVE-2019-6287 | High | 8.1 | 2019-04-10 | In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed… |
CVE-2018-20321 | High | 8.8 | 2019-04-10 | An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a po… |
CVE-2019-6690 | High | 7.5 | 2019-03-21 | python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg… |
CVE-2017-16232 | High | 7.5 | 2019-03-21 | LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c… |
CVE-2018-20106 | Medium | 6.5 | 2019-03-15 | In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or siml… |
CVE-2018-17956 | High | 7.8 | 2019-03-15 | In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provisio… |
CVE-2018-17955 | Low | 2.2 | 2019-03-15 | In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection |
CVE-2018-19640 | Medium | 4.4 | 2019-03-05 | If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can k… |
CVE-2018-19639 | Medium | 6.7 | 2019-03-05 | If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-… |
CVE-2018-19638 | Low | 2.2 | 2019-03-05 | In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the direc… |
CVE-2018-19637 | Low | 2.8 | 2019-03-05 | Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protect… |
CVE-2018-19636 | High | 7.3 | 2019-03-05 | Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an… |
CVE-2019-9211 | Medium | 6.5 | 2019-02-27 | There is a reachable assertion abort in the function write_long_string_missing_values() in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0 that will lead… |
CVE-2019-3475 | High | 7.8 | 2019-02-20 | A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to esca… |
CVE-2019-3474 | Medium | 6.5 | 2019-02-20 | A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to downl… |
CVE-2019-7317 | Medium | 5.3 | 2019-02-04 | png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute. |
CVE-2018-16876 | Medium | 5.3 | 2019-01-03 | ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible d… |
CVE-2018-17957 | Low | 3.4 | 2018-12-26 | The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing lo… |
CVE-2018-16874 | High | 8.1 | 2018-12-14 | In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go pa… |
CVE-2018-16873 | High | 8.1 | 2018-12-14 | In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of… |
CVE-2018-19655 | High | 8.8 | 2018-11-29 | A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remote attacker t… |
CVE-2018-12122 | High | 7.5 | 2018-11-28 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by… |