mgr-push vulnerabilities (SUSE)
164 vulnerabilities.
mgr-pushSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 Highmgr-pushSUSEPrometheus: remote read endpoint allows denial of service via crafted snappy payload7.5 Highmgr-pushSUSEPrometheus Azure AD remote write OAuth client secret exposed via config API7.5 Highmgr-pushSUSEApache Thrift: c_glib dispatch stack overflow5.3 Mediummgr-pushSUSEApache Thrift: Go TFramedTransport uint32 overflow7.5 Highmgr-pushSUSESecurity update for python-pyOpenSSLNo scoremgr-pushSUSEpip self-update functionality can import newly installed modules after wheel installation5.3 Mediummgr-pushSUSEBaseCookie.js_output() does not neutralize embedded characters2.1 Lowmgr-pushSUSElxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files7.5 Highmgr-pushSUSEpip doesn't reject concatenated ZIP and tar archives4.6 Mediummgr-pushSUSEIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 Highmgr-pushSUSEUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure9.1 Criticalmgr-pushSUSEPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3 Mediummgr-pushSUSEBase64 decoding stops at first padded quad by default6.0 Mediummgr-pushSUSEHTTP client proxy tunnel headers not validated for CR/LF5.7 Mediummgr-pushSUSEOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies5.3 Mediummgr-pushSUSEGo JOSE affect by a panic in JWE decryption7.5 Highmgr-pushSUSEpkgutil.get_data() does not enforce documented restrictions0.0 Nonemgr-pushSUSEpyOpenSSL DTLS cookie callback buffer overflow7.2 Highmgr-pushSUSERollup 4 has Arbitrary File Write via Path Traversal8.8 Highmgr-pushSUSEIncorrect calculation in CIRCL secp384r1 CombinedMult2.9 Lowmgr-pushSUSEPublic Dashboards time range restriction on annotations can be bypassed5.3 Mediummgr-pushSUSEHeap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak6.9 Mediummgr-pushSUSEjsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions9.2 Criticalmgr-pushSUSEUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 Criticalmgr-pushSUSELimited path traversal when installing wheel archives2.0 Lowmgr-pushSUSEJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 Criticalmgr-pushSUSEReact Router has Path Traversal in File Session Storage9.1 Criticalmgr-pushSUSEExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 Highmgr-pushSUSETornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5 Highmgr-pushSUSETornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5 Highmgr-pushSUSETornado vulnerable to Header Injection and XSS via reason argument5.4 Mediummgr-pushSUSEExcessive read buffering DoS in http.client6.3 Mediummgr-pushSUSESalt Master authentication protocol downgrade may enable minion impersonation7.5 Highmgr-pushSUSESalt junos module uses an unsafe YAML loader which may allow unintended code execution7.3 Highmgr-pushSUSECVE-2025-128168.6 Highmgr-pushSUSEGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure5.3 Mediummgr-pushSUSEAn open redirect vulnerability has been identified in Grafana OSS organization switching...4.2 Mediummgr-pushSUSEGrafana is vulnerable to XSS attacks through open redirects and path traversal7.6 Highmgr-pushSUSEGrafana's insecure DingDing Alert integration exposes sensitive information4.3 Mediummgr-pushSUSESensitive headers not cleared on cross-origin redirect in net/http6.8 Mediummgr-pushSUSEHTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net4.4 Mediummgr-pushSUSEDenial of service via malicious preflight requests in github.com/rs/cors7.5 Highmgr-pushSUSEHTTP/2 CONTINUATION flood in net/http7.5 Highmgr-pushSUSEUsers outside an organization can delete a snapshot with its key6.5 Mediummgr-pushSUSEIncorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http4.3 Mediummgr-pushSUSEJinja vulnerable to Cross-Site Scripting (XSS)5.4 Mediummgr-pushSUSEAlertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint7.5 Highmgr-pushSUSEGrafana vulnerable to Authentication Bypass by Spoofing9.4 Criticalmgr-pushSUSEGrafana has Broken Access Control in Alert manager: Viewer can send test alerts4.1 Medium- Show moreLoading…