Suse vulnerabilities
253 CVEs and advisories name Suse as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-31249[RANCHER] OS command injection in Rancher and Fleet
- CVE-2022-21953Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster
- CVE-2022-43754SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do
- CVE-2022-43753SUMA/UYUNI arbitrary file disclosure vulnerability in ScapResultDownload
- CVE-2022-31255SUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewAction
- CVE-2022-31256sendmail: mail to root privilege escalation via sm-client.pre script
- CVE-2022-31252permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()
- CVE-2022-31251slurm: %post for slurm-testsuite operates as root in user owned directory
- CVE-2022-31247Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)
- CVE-2021-36783Rancher: Failure to properly sanitize credentials in cluster template answers
- CVE-2021-36782Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object
- CVE-2022-31248SUMA user enumeration via weak error message
- CVE-2022-21952SUMA unauthenticated remote DoS via resource exhaustion
- CVE-2022-21951Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden
- CVE-2022-21949Multiple XXE vulnerabilities in OBS
- CVE-2021-4200Write access to the Catalog for any user when restricted-admin role is enabled
- CVE-2021-36784Privilege escalation for users with create/update permissions in Global Roles
- CVE-2021-36778Exposure of repository credentials to external third-party sources
- CVE-2021-36776Steve API proxy impersonation
- CVE-2021-36775Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings
- CVE-2022-21947rancher desktop: Dashboard API is network accessible
- CVE-2021-46705grub2-once uses fixed file name in /var/tmp
- CVE-2021-36780Unauthorized data access from replicas through vulnerable instance manager pods
- CVE-2021-36779Host operations allowed in privileged Longhorn managed pods
- CVE-2021-32000clone-master-clean-up: dangerous file system operations
- CVE-2021-32001K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token
- CVE-2019-18906cryptctl: client side password hashing is equivalent to clear text password storage
- CVE-2021-25321arpwatch: Local privilege escalation from runtime user to root
- CVE-2021-31998inn: %post calls user owned file allowing local privilege escalation to root
- CVE-2021-25317cups: ownership of /var/log/cups allows the lp user to create files as root