uyuni-tools vulnerabilities (SUSE)
137 vulnerabilities.
-
uyuni-toolsSUSE Security update 5.2.1 for Multi-Linux Manager Server No score -
uyuni-toolsSUSE Security update 5.2.1 for Multi-Linux Manager Server No score -
uyuni-toolsSUSE Security update 5.2.1 for Multi-Linux Manager Server No score -
uyuni-toolsSUSE Session takeover via Auth Proxy cache key collision 7.1 High -
uyuni-toolsSUSE SQL Data Source Plugin: OOM DoS via $__timeGroup macro 6.5 Medium -
uyuni-toolsSUSE Broken access control in dashboard snapshots 6.3 Medium -
uyuni-toolsSUSE CVE-2026-17033 CVE Record 6.8 Medium -
uyuni-toolsSUSE CVE-2026-17183 CVE Record 7.1 High -
uyuni-toolsSUSE pip absolute path traversal during download from malicious package indexes 5.6 Medium -
uyuni-toolsSUSE kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default 9.1 Critical -
uyuni-toolsSUSE CVE-2026-21723 Record 5.3 Medium -
uyuni-toolsSUSE Infinite loop on invalid input in golang.org/x/text 7.5 High -
uyuni-toolsSUSE Stored XSS in the table panel (TableNG) 6.8 Medium -
uyuni-toolsSUSE Pre-authentication denial of service via the OAuth login route 5.3 Medium -
uyuni-toolsSUSE Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations 8.7 High -
uyuni-toolsSUSE Tarfile.extract() doesn't fully respect filter parameter 2.0 Low -
uyuni-toolsSUSE lxml: javascript: URL bypass in Cleaner via xlink:href 8.2 High -
uyuni-toolsSUSE tarfile opened in streaming mode mishandles EOF 8.2 High -
uyuni-toolsSUSE Configuration Injection via Carriage Return (\r) in write() method 4.1 Medium -
uyuni-toolsSUSE tarfile extraction filter bypass allows escaping the destination directory 7.8 High -
uyuni-toolsSUSE Pre-authentication denial of service in the public dashboard query endpoint 7.5 High -
uyuni-toolsSUSE Stored XSS in the Geomap panel tile-layer attribution 7.3 High -
uyuni-toolsSUSE tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) 7.5 High -
uyuni-toolsSUSE Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient 7.7 High -
uyuni-toolsSUSE sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes 5.4 Medium -
uyuni-toolsSUSE Tornado: Out-of-bounds memory access in C extension 5.3 Medium -
uyuni-toolsSUSE tarfile.data_filter path traversal bypass allows writing outside the extraction directory 6.9 Medium -
uyuni-toolsSUSE Potential DoS via quadratic complexity in unicodedata.normalize() 6.3 Medium -
uyuni-toolsSUSE React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint 7.5 High -
uyuni-toolsSUSE React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE 8.1 High -
uyuni-toolsSUSE React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation 6.6 Medium -
uyuni-toolsSUSE OpenTelemetry-Go's baggage parsing no longer caps raw header length 5.3 Medium -
uyuni-toolsSUSE pip can extract console_scripts and gui_scripts outside installation directory 4.1 Medium -
uyuni-toolsSUSE Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html 6.1 Medium -
uyuni-toolsSUSE Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 6.1 Medium -
uyuni-toolsSUSE Invoking duplicate attributes can cause XSS in golang.org/x/net/html 6.1 Medium -
uyuni-toolsSUSE Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 6.1 Medium -
uyuni-toolsSUSE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 6.5 Medium -
uyuni-toolsSUSE Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix 6.9 Medium -
uyuni-toolsSUSE Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` 9.3 Critical -
uyuni-toolsSUSE FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address 5.9 Medium -
uyuni-toolsSUSE IDOR in Annotations API allows unprivileged users to DELETE annotation 4.3 Medium -
uyuni-toolsSUSE Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro 6.5 Medium -
uyuni-toolsSUSE Grafana plugin resources can lead to unbounded memory allocation 6.5 Medium -
uyuni-toolsSUSE Auth Proxy IPv6 whitelist bypass 7.4 High -
uyuni-toolsSUSE SQL Expressions Read File From Disk 6.3 Medium -
uyuni-toolsSUSE BAC in Snapshot API allows deletion of unauthorized dashboard snapshots 6.5 Medium -
uyuni-toolsSUSE Users can generate Service Account tokens after permissions removal 5.9 Medium -
uyuni-toolsSUSE Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin 7.1 High -
uyuni-toolsSUSE Grafana Live push endpoint allows unbounded memory allocation leading to OOM 6.5 Medium - Show olderLoading…