spacecmd vulnerabilities (SUSE)
260 vulnerabilities.
spacecmdSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 HighspacecmdSUSEPrometheus: remote read endpoint allows denial of service via crafted snappy payload7.5 HighspacecmdSUSEPrometheus Azure AD remote write OAuth client secret exposed via config API7.5 HighspacecmdSUSEApache Thrift: c_glib dispatch stack overflow5.3 MediumspacecmdSUSEApache Thrift: Go TFramedTransport uint32 overflow7.5 HighspacecmdSUSESecurity update for python-pyOpenSSLNo scorespacecmdSUSEpip self-update functionality can import newly installed modules after wheel installation5.3 MediumspacecmdSUSEBaseCookie.js_output() does not neutralize embedded characters2.1 LowspacecmdSUSElxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files7.5 HighspacecmdSUSEpip doesn't reject concatenated ZIP and tar archives4.6 MediumspacecmdSUSEIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 HighspacecmdSUSEUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure9.1 CriticalspacecmdSUSEPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3 MediumspacecmdSUSEBase64 decoding stops at first padded quad by default6.0 MediumspacecmdSUSEHTTP client proxy tunnel headers not validated for CR/LF5.7 MediumspacecmdSUSEOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies5.3 MediumspacecmdSUSEGo JOSE affect by a panic in JWE decryption7.5 HighspacecmdSUSEQuery resampling can cause unbounded memory allocations6.5 MediumspacecmdSUSEGrafana Testdata datasource can issue unbounded memory allocations6.5 MediumspacecmdSUSERCE on Grafana via sqlExpressions9.1 CriticalspacecmdSUSEPublic dashboards discloses all direct mode datasources6.5 MediumspacecmdSUSEMissing Protected-field Authorization in Provisioning Contact Points API5.4 MediumspacecmdSUSEgRPC-Go has an authorization bypass via missing leading slash in :path9.1 CriticalspacecmdSUSEpkgutil.get_data() does not enforce documented restrictions0.0 NonespacecmdSUSEpyOpenSSL DTLS cookie callback buffer overflow7.2 HighspacecmdSUSETornado has a DoS due to too many multipart parts8.7 HighspacecmdSUSEAuthorization Bypass via TOCTOU in Grafana Datasource Deletion by Name2.6 LowspacecmdSUSERollup 4 has Arbitrary File Write via Path Traversal8.8 HighspacecmdSUSEIncorrect calculation in CIRCL secp384r1 CombinedMult2.9 LowspacecmdSUSEfilippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity1.7 LowspacecmdSUSEPublic Dashboards time range restriction on annotations can be bypassed5.3 MediumspacecmdSUSEHeap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak6.9 MediumspacecmdSUSEjsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions9.2 CriticalspacecmdSUSEUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 CriticalspacecmdSUSELimited path traversal when installing wheel archives2.0 LowspacecmdSUSEJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 CriticalspacecmdSUSEDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation8.1 HighspacecmdSUSEUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out7.5 HighspacecmdSUSEPrototype Pollution Vulnerability in Lodash _.unset and _.omit functions6.9 MediumspacecmdSUSEReact Router has Path Traversal in File Session Storage9.1 CriticalspacecmdSUSEExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 HighspacecmdSUSETornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5 HighspacecmdSUSETornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5 HighspacecmdSUSETornado vulnerable to Header Injection and XSS via reason argument5.4 MediumspacecmdSUSEExcessive read buffering DoS in http.client6.3 MediumspacecmdSUSESalt Master authentication protocol downgrade may enable minion impersonation7.5 HighspacecmdSUSESalt junos module uses an unsafe YAML loader which may allow unintended code execution7.3 HighspacecmdSUSECVE-2025-128168.6 HighspacecmdSUSEGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure5.3 MediumspacecmdSUSESUSE Multi Linux Manager allows code execution via unprotected websocket endpoint9.3 Critical- Show moreLoading…