spacecmd vulnerabilities (SUSE)
260 vulnerabilities.
-
spacecmdSUSE Session takeover via Auth Proxy cache key collision 7.1 High -
spacecmdSUSE SQL Data Source Plugin: OOM DoS via $__timeGroup macro 6.5 Medium -
spacecmdSUSE Broken access control in dashboard snapshots 6.3 Medium -
spacecmdSUSE CVE-2026-17033 CVE Record 6.8 Medium -
spacecmdSUSE CVE-2026-17183 CVE Record 7.1 High -
spacecmdSUSE pip absolute path traversal during download from malicious package indexes 5.6 Medium -
spacecmdSUSE kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default 9.1 Critical -
spacecmdSUSE CVE-2026-21723 Record 5.3 Medium -
spacecmdSUSE Infinite loop on invalid input in golang.org/x/text 7.5 High -
spacecmdSUSE Stored XSS in the table panel (TableNG) 6.8 Medium -
spacecmdSUSE Pre-authentication denial of service via the OAuth login route 5.3 Medium -
spacecmdSUSE Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations 8.7 High -
spacecmdSUSE Tarfile.extract() doesn't fully respect filter parameter 2.0 Low -
spacecmdSUSE lxml: javascript: URL bypass in Cleaner via xlink:href 8.2 High -
spacecmdSUSE tarfile opened in streaming mode mishandles EOF 8.2 High -
spacecmdSUSE Configuration Injection via Carriage Return (\r) in write() method 4.1 Medium -
spacecmdSUSE tarfile extraction filter bypass allows escaping the destination directory 7.8 High -
spacecmdSUSE Pre-authentication denial of service in the public dashboard query endpoint 7.5 High -
spacecmdSUSE Stored XSS in the Geomap panel tile-layer attribution 7.3 High -
spacecmdSUSE tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) 7.5 High -
spacecmdSUSE Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient 7.7 High -
spacecmdSUSE sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes 5.4 Medium -
spacecmdSUSE Tornado: Out-of-bounds memory access in C extension 5.3 Medium -
spacecmdSUSE tarfile.data_filter path traversal bypass allows writing outside the extraction directory 6.9 Medium -
spacecmdSUSE Potential DoS via quadratic complexity in unicodedata.normalize() 6.3 Medium -
spacecmdSUSE React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint 7.5 High -
spacecmdSUSE React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE 8.1 High -
spacecmdSUSE React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation 6.6 Medium -
spacecmdSUSE OpenTelemetry-Go's baggage parsing no longer caps raw header length 5.3 Medium -
spacecmdSUSE pip can extract console_scripts and gui_scripts outside installation directory 4.1 Medium -
spacecmdSUSE Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html 6.1 Medium -
spacecmdSUSE Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 6.1 Medium -
spacecmdSUSE Invoking duplicate attributes can cause XSS in golang.org/x/net/html 6.1 Medium -
spacecmdSUSE Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 6.1 Medium -
spacecmdSUSE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 6.5 Medium -
spacecmdSUSE Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix 6.9 Medium -
spacecmdSUSE Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` 9.3 Critical -
spacecmdSUSE FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address 5.9 Medium -
spacecmdSUSE IDOR in Annotations API allows unprivileged users to DELETE annotation 4.3 Medium -
spacecmdSUSE Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro 6.5 Medium -
spacecmdSUSE Grafana plugin resources can lead to unbounded memory allocation 6.5 Medium -
spacecmdSUSE Auth Proxy IPv6 whitelist bypass 7.4 High -
spacecmdSUSE SQL Expressions Read File From Disk 6.3 Medium -
spacecmdSUSE BAC in Snapshot API allows deletion of unauthorized dashboard snapshots 6.5 Medium -
spacecmdSUSE Users can generate Service Account tokens after permissions removal 5.9 Medium -
spacecmdSUSE Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin 7.1 High -
spacecmdSUSE Grafana Live push endpoint allows unbounded memory allocation leading to OOM 6.5 Medium -
spacecmdSUSE Viewer-triggered race condition in Grafana Live leads to complete server crash 6.5 Medium -
spacecmdSUSE The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection 6.3 Medium -
spacecmdSUSE urllib3: Sensitive headers forwarded across origins in proxied low-level redirects 8.2 High - Show olderLoading…