dracut-saltboot vulnerabilities (SUSE)
115 vulnerabilities.
dracut-saltbootSUSEInvoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html6.1 Mediumdracut-saltbootSUSEInvoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html6.1 Mediumdracut-saltbootSUSEInvoking duplicate attributes can cause XSS in golang.org/x/net/html6.1 Mediumdracut-saltbootSUSEInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html6.1 Mediumdracut-saltbootSUSEInvoking denial of service when parsing arbitrary HTML in golang.org/x/net/html6.5 Mediumdracut-saltbootSUSEIDOR in Annotations API allows unprivileged users to DELETE annotation4.3 Mediumdracut-saltbootSUSEGrafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro6.5 Mediumdracut-saltbootSUSEGrafana plugin resources can lead to unbounded memory allocation6.5 Mediumdracut-saltbootSUSEAuth Proxy IPv6 whitelist bypass7.4 Highdracut-saltbootSUSESQL Expressions Read File From Disk6.3 Mediumdracut-saltbootSUSEBAC in Snapshot API allows deletion of unauthorized dashboard snapshots6.5 Mediumdracut-saltbootSUSEUsers can generate Service Account tokens after permissions removal5.9 Mediumdracut-saltbootSUSEDashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin7.1 Highdracut-saltbootSUSEGrafana Live push endpoint allows unbounded memory allocation leading to OOM6.5 Mediumdracut-saltbootSUSEViewer-triggered race condition in Grafana Live leads to complete server crash6.5 Mediumdracut-saltbootSUSEPrometheus: remote read endpoint allows denial of service via crafted snappy payload7.5 Highdracut-saltbootSUSEPrometheus Azure AD remote write OAuth client secret exposed via config API7.5 Highdracut-saltbootSUSEApache Thrift: Go TFramedTransport uint32 overflow7.5 Highdracut-saltbootSUSEPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3 Mediumdracut-saltbootSUSEGo JOSE affect by a panic in JWE decryption7.5 Highdracut-saltbootSUSERollup 4 has Arbitrary File Write via Path Traversal8.8 Highdracut-saltbootSUSEPublic Dashboards time range restriction on annotations can be bypassed5.3 Mediumdracut-saltbootSUSEjsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions9.2 Criticaldracut-saltbootSUSEUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 Criticaldracut-saltbootSUSEJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 Criticaldracut-saltbootSUSEDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation8.1 Highdracut-saltbootSUSEUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out7.5 Highdracut-saltbootSUSEPrototype Pollution Vulnerability in Lodash _.unset and _.omit functions6.9 Mediumdracut-saltbootSUSEExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 Highdracut-saltbootSUSETornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5 Highdracut-saltbootSUSETornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5 Highdracut-saltbootSUSETornado vulnerable to Header Injection and XSS via reason argument5.4 Mediumdracut-saltbootSUSESalt Master authentication protocol downgrade may enable minion impersonation7.5 Highdracut-saltbootSUSESalt junos module uses an unsafe YAML loader which may allow unintended code execution7.3 Highdracut-saltbootSUSECVE-2025-128168.6 Highdracut-saltbootSUSEGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure5.3 Mediumdracut-saltbootSUSEAn open redirect vulnerability has been identified in Grafana OSS organization switching...4.2 Mediumdracut-saltbootSUSEGrafana is vulnerable to XSS attacks through open redirects and path traversal7.6 Highdracut-saltbootSUSEGrafana's insecure DingDing Alert integration exposes sensitive information4.3 Mediumdracut-saltbootSUSESecurity update for SUSE Manager Client ToolsNo scoredracut-saltbootSUSEMisuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto9.1 Criticaldracut-saltbootSUSEDatabase password leaked by systemd uyuni-server-attestation service5.7 Mediumdracut-saltbootSUSEBad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt3.1 Lowdracut-saltbootSUSEGrafana alerting wrong permission on datasource rule write endpoint5.1 Mediumdracut-saltbootSUSEDenial of service via malicious preflight requests in github.com/rs/cors7.5 Highdracut-saltbootSUSEUsers outside an organization can delete a snapshot with its key6.5 Mediumdracut-saltbootSUSEEmail Validation Bypass And Preventing Sign Up From Email's Owner5.4 Mediumdracut-saltbootSUSEAnsible-core: possible information leak in tasks that ignore ansible_no_log configuration5.0 Mediumdracut-saltbootSUSEAnsible: template injection7.1 Highdracut-saltbootSUSEGrafana vulnerable to Authentication Bypass by Spoofing9.4 Critical- Show olderLoading…