spacewalk-client-tools vulnerabilities (SUSE)
225 vulnerabilities.
spacewalk-client-toolsSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 Highspacewalk-client-toolsSUSEPrometheus: remote read endpoint allows denial of service via crafted snappy payload7.5 Highspacewalk-client-toolsSUSEPrometheus Azure AD remote write OAuth client secret exposed via config API7.5 Highspacewalk-client-toolsSUSEApache Thrift: c_glib dispatch stack overflow5.3 Mediumspacewalk-client-toolsSUSEApache Thrift: Go TFramedTransport uint32 overflow7.5 Highspacewalk-client-toolsSUSESecurity update for python-pyOpenSSLNo scorespacewalk-client-toolsSUSEpip self-update functionality can import newly installed modules after wheel installation5.3 Mediumspacewalk-client-toolsSUSEBaseCookie.js_output() does not neutralize embedded characters2.1 Lowspacewalk-client-toolsSUSElxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files7.5 Highspacewalk-client-toolsSUSEpip doesn't reject concatenated ZIP and tar archives4.6 Mediumspacewalk-client-toolsSUSEIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 Highspacewalk-client-toolsSUSEUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure9.1 Criticalspacewalk-client-toolsSUSEPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3 Mediumspacewalk-client-toolsSUSEBase64 decoding stops at first padded quad by default6.0 Mediumspacewalk-client-toolsSUSEHTTP client proxy tunnel headers not validated for CR/LF5.7 Mediumspacewalk-client-toolsSUSEOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies5.3 Mediumspacewalk-client-toolsSUSEGo JOSE affect by a panic in JWE decryption7.5 Highspacewalk-client-toolsSUSEpkgutil.get_data() does not enforce documented restrictions0.0 Nonespacewalk-client-toolsSUSEpyOpenSSL DTLS cookie callback buffer overflow7.2 Highspacewalk-client-toolsSUSERollup 4 has Arbitrary File Write via Path Traversal8.8 Highspacewalk-client-toolsSUSEIncorrect calculation in CIRCL secp384r1 CombinedMult2.9 Lowspacewalk-client-toolsSUSEPublic Dashboards time range restriction on annotations can be bypassed5.3 Mediumspacewalk-client-toolsSUSEHeap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak6.9 Mediumspacewalk-client-toolsSUSEjsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions9.2 Criticalspacewalk-client-toolsSUSEUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 Criticalspacewalk-client-toolsSUSELimited path traversal when installing wheel archives2.0 Lowspacewalk-client-toolsSUSEJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 Criticalspacewalk-client-toolsSUSEReact Router has Path Traversal in File Session Storage9.1 Criticalspacewalk-client-toolsSUSEExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 Highspacewalk-client-toolsSUSETornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5 Highspacewalk-client-toolsSUSETornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5 Highspacewalk-client-toolsSUSETornado vulnerable to Header Injection and XSS via reason argument5.4 Mediumspacewalk-client-toolsSUSEExcessive read buffering DoS in http.client6.3 Mediumspacewalk-client-toolsSUSESalt Master authentication protocol downgrade may enable minion impersonation7.5 Highspacewalk-client-toolsSUSESalt junos module uses an unsafe YAML loader which may allow unintended code execution7.3 Highspacewalk-client-toolsSUSECVE-2025-128168.6 Highspacewalk-client-toolsSUSESUSE Multi Linux Manager allows code execution via unprotected websocket endpoint9.3 Criticalspacewalk-client-toolsSUSEMulti Linux Manager epxoses the plain text HTTP Proxy user:password in logs6.9 Mediumspacewalk-client-toolsSUSEAn open redirect vulnerability has been identified in Grafana OSS organization switching...4.2 Mediumspacewalk-client-toolsSUSEGrafana is vulnerable to XSS attacks through open redirects and path traversal7.6 Highspacewalk-client-toolsSUSEGrafana's insecure DingDing Alert integration exposes sensitive information4.3 Mediumspacewalk-client-toolsSUSESensitive headers not cleared on cross-origin redirect in net/http6.8 Mediumspacewalk-client-toolsSUSEReflected XSS in spacewalk-java5.6 Mediumspacewalk-client-toolsSUSEReflected XSS in SystemsController.java in spacewalk-java5.6 Mediumspacewalk-client-toolsSUSEHTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net4.4 Mediumspacewalk-client-toolsSUSEReflected XSS in Setup Wizard, Organization Credentials in spacewalk-web4.6 Mediumspacewalk-client-toolsSUSEReflected XSS in Setup Wizard, HTTP Proxy credentials pane in spacewalk-web4.6 Mediumspacewalk-client-toolsSUSECobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes9.8 Criticalspacewalk-client-toolsSUSEAnsible-core: exposure of sensitive information in ansible vault files due to improper logging5.5 Mediumspacewalk-client-toolsSUSEDenial of service via malicious preflight requests in github.com/rs/cors7.5 High- Show moreLoading…