Opensuse vulnerabilities
83 CVEs and advisories name Opensuse as an affected vendor, newest first. Follow it as a feed.
- CVE-2021-31997python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root
- CVE-2021-31998inn: %post calls user owned file allowing local privilege escalation to root
- CVE-2021-25317cups: ownership of /var/log/cups allows the lp user to create files as root
- CVE-2021-25319virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group
- CVE-2021-25315salt-api unauthenticated remote code execution
- CVE-2020-8032Local privilege escalation to root due to insecure tmp file usage
- CVE-2020-8027openldap uses fixed paths in /tmp
- CVE-2020-8031obs: Stored XSS
- CVE-2018-12475obs-service-download_files allows downloading from localhost or intranet hosts
- CVE-2020-8023Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2
- CVE-2020-8025outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues
- CVE-2020-8026inn: non-root owned files
- CVE-2020-8014kopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackage
- CVE-2019-3681osc: stores downloaded (supposed) RPM in network-controlled filesystem paths
- CVE-2020-8019syslog-ng: Local privilege escalation from new to root in %post
- CVE-2020-8024Problematic permissions in hylafax+ packaging allow escalation from uucp to other users
- CVE-2020-8021unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service
- CVE-2020-8020Persistent XSS in markdown parser used by obs-server
- CVE-2019-18904Migrations requests can cause DoS on rmt
- CVE-2020-8017race condition on texlive-filesystem cron job allows for the deletion of unintended files
- CVE-2020-8016race condition in the packaging of texlive-filesysten
- CVE-2020-8015Local privilege escalation in exim package from user mail to root
- CVE-2019-3696pcp: Local privilege escalation from user pcp to root through migrate_tempdirs
- CVE-2019-3695pcp: Local privilege escalation from user pcp to root
- CVE-2019-18903wicked: Use-after-free when receiving invalid DHCP6 IA_PD option
- CVE-2019-18902wicked: Use-after-free when receiving invalid DHCP6 client options
- CVE-2019-18897Local privilege escalation from user salt to root
- CVE-2019-3698nagios cron job allows privilege escalation from user nagios to root
- CVE-2018-20105yast2-rmt exposes CA private key passhrase in log-file
- CVE-2018-12476obs-service-extract_file's outfilename parameter allows to write files outside of package directory