mgr-push vulnerabilities (SUSE)
164 vulnerabilities.
-
mgr-pushSUSE Session takeover via Auth Proxy cache key collision 7.1 High -
mgr-pushSUSE SQL Data Source Plugin: OOM DoS via $__timeGroup macro 6.5 Medium -
mgr-pushSUSE Broken access control in dashboard snapshots 6.3 Medium -
mgr-pushSUSE CVE-2026-17033 CVE Record 6.8 Medium -
mgr-pushSUSE CVE-2026-17183 CVE Record 7.1 High -
mgr-pushSUSE pip absolute path traversal during download from malicious package indexes 5.6 Medium -
mgr-pushSUSE kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default 9.1 Critical -
mgr-pushSUSE CVE-2026-21723 Record 5.3 Medium -
mgr-pushSUSE Infinite loop on invalid input in golang.org/x/text 7.5 High -
mgr-pushSUSE Stored XSS in the table panel (TableNG) 6.8 Medium -
mgr-pushSUSE Pre-authentication denial of service via the OAuth login route 5.3 Medium -
mgr-pushSUSE Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations 8.7 High -
mgr-pushSUSE Tarfile.extract() doesn't fully respect filter parameter 2.0 Low -
mgr-pushSUSE lxml: javascript: URL bypass in Cleaner via xlink:href 8.2 High -
mgr-pushSUSE tarfile opened in streaming mode mishandles EOF 8.2 High -
mgr-pushSUSE Configuration Injection via Carriage Return (\r) in write() method 4.1 Medium -
mgr-pushSUSE tarfile extraction filter bypass allows escaping the destination directory 7.8 High -
mgr-pushSUSE Pre-authentication denial of service in the public dashboard query endpoint 7.5 High -
mgr-pushSUSE Stored XSS in the Geomap panel tile-layer attribution 7.3 High -
mgr-pushSUSE tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) 7.5 High -
mgr-pushSUSE Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient 7.7 High -
mgr-pushSUSE sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes 5.4 Medium -
mgr-pushSUSE Tornado: Out-of-bounds memory access in C extension 5.3 Medium -
mgr-pushSUSE tarfile.data_filter path traversal bypass allows writing outside the extraction directory 6.9 Medium -
mgr-pushSUSE Potential DoS via quadratic complexity in unicodedata.normalize() 6.3 Medium -
mgr-pushSUSE React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint 7.5 High -
mgr-pushSUSE React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE 8.1 High -
mgr-pushSUSE React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation 6.6 Medium -
mgr-pushSUSE OpenTelemetry-Go's baggage parsing no longer caps raw header length 5.3 Medium -
mgr-pushSUSE pip can extract console_scripts and gui_scripts outside installation directory 4.1 Medium -
mgr-pushSUSE Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html 6.1 Medium -
mgr-pushSUSE Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 6.1 Medium -
mgr-pushSUSE Invoking duplicate attributes can cause XSS in golang.org/x/net/html 6.1 Medium -
mgr-pushSUSE Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 6.1 Medium -
mgr-pushSUSE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 6.5 Medium -
mgr-pushSUSE Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix 6.9 Medium -
mgr-pushSUSE Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` 9.3 Critical -
mgr-pushSUSE FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address 5.9 Medium -
mgr-pushSUSE IDOR in Annotations API allows unprivileged users to DELETE annotation 4.3 Medium -
mgr-pushSUSE Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro 6.5 Medium -
mgr-pushSUSE Grafana plugin resources can lead to unbounded memory allocation 6.5 Medium -
mgr-pushSUSE Auth Proxy IPv6 whitelist bypass 7.4 High -
mgr-pushSUSE SQL Expressions Read File From Disk 6.3 Medium -
mgr-pushSUSE BAC in Snapshot API allows deletion of unauthorized dashboard snapshots 6.5 Medium -
mgr-pushSUSE Users can generate Service Account tokens after permissions removal 5.9 Medium -
mgr-pushSUSE Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin 7.1 High -
mgr-pushSUSE Grafana Live push endpoint allows unbounded memory allocation leading to OOM 6.5 Medium -
mgr-pushSUSE Viewer-triggered race condition in Grafana Live leads to complete server crash 6.5 Medium -
mgr-pushSUSE The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection 6.3 Medium -
mgr-pushSUSE urllib3: Sensitive headers forwarded across origins in proxied low-level redirects 8.2 High - Show olderLoading…