uyuni-tools vulnerabilities (SUSE)
137 vulnerabilities.
uyuni-toolsSUSEViewer-triggered race condition in Grafana Live leads to complete server crash6.5 Mediumuyuni-toolsSUSEThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protection6.3 Mediumuyuni-toolsSUSEurllib3: Sensitive headers forwarded across origins in proxied low-level redirects8.2 Highuyuni-toolsSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 Highuyuni-toolsSUSEPrometheus: remote read endpoint allows denial of service via crafted snappy payload7.5 Highuyuni-toolsSUSEPrometheus Azure AD remote write OAuth client secret exposed via config API7.5 Highuyuni-toolsSUSEpgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS7.5 Highuyuni-toolsSUSEApache Thrift: c_glib dispatch stack overflow5.3 Mediumuyuni-toolsSUSEApache Thrift: Go TFramedTransport uint32 overflow7.5 Highuyuni-toolsSUSESecurity update for python-pyOpenSSLNo scoreuyuni-toolsSUSEpip self-update functionality can import newly installed modules after wheel installation5.3 Mediumuyuni-toolsSUSEBaseCookie.js_output() does not neutralize embedded characters2.1 Lowuyuni-toolsSUSElxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files7.5 Highuyuni-toolsSUSEpip doesn't reject concatenated ZIP and tar archives4.6 Mediumuyuni-toolsSUSEIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 Highuyuni-toolsSUSEUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure9.1 Criticaluyuni-toolsSUSEPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3 Mediumuyuni-toolsSUSEBase64 decoding stops at first padded quad by default6.0 Mediumuyuni-toolsSUSEHTTP client proxy tunnel headers not validated for CR/LF5.7 Mediumuyuni-toolsSUSEOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies5.3 Mediumuyuni-toolsSUSEGo JOSE affect by a panic in JWE decryption7.5 Highuyuni-toolsSUSEQuery resampling can cause unbounded memory allocations6.5 Mediumuyuni-toolsSUSEGrafana Testdata datasource can issue unbounded memory allocations6.5 Mediumuyuni-toolsSUSERCE on Grafana via sqlExpressions9.1 Criticaluyuni-toolsSUSEPublic dashboards discloses all direct mode datasources6.5 Mediumuyuni-toolsSUSEMissing Protected-field Authorization in Provisioning Contact Points API5.4 Mediumuyuni-toolsSUSEgRPC-Go has an authorization bypass via missing leading slash in :path9.1 Criticaluyuni-toolsSUSEpkgutil.get_data() does not enforce documented restrictions0.0 Noneuyuni-toolsSUSEpyOpenSSL DTLS cookie callback buffer overflow7.2 Highuyuni-toolsSUSETornado has a DoS due to too many multipart parts8.7 Highuyuni-toolsSUSEAuthorization Bypass via TOCTOU in Grafana Datasource Deletion by Name2.6 Lowuyuni-toolsSUSERollup 4 has Arbitrary File Write via Path Traversal8.8 Highuyuni-toolsSUSEIncorrect calculation in CIRCL secp384r1 CombinedMult2.9 Lowuyuni-toolsSUSEfilippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity1.7 Lowuyuni-toolsSUSEPublic Dashboards time range restriction on annotations can be bypassed5.3 Mediumuyuni-toolsSUSEHeap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak6.9 Mediumuyuni-toolsSUSEjsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions9.2 Criticaluyuni-toolsSUSEUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 Criticaluyuni-toolsSUSELimited path traversal when installing wheel archives2.0 Lowuyuni-toolsSUSEJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 Criticaluyuni-toolsSUSEDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation8.1 Highuyuni-toolsSUSEUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out7.5 Highuyuni-toolsSUSEPrototype Pollution Vulnerability in Lodash _.unset and _.omit functions6.9 Mediumuyuni-toolsSUSEReact Router has Path Traversal in File Session Storage9.1 Criticaluyuni-toolsSUSEExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 Highuyuni-toolsSUSETornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5 Highuyuni-toolsSUSETornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5 Highuyuni-toolsSUSETornado vulnerable to Header Injection and XSS via reason argument5.4 Mediumuyuni-toolsSUSEExcessive read buffering DoS in http.client6.3 Mediumuyuni-toolsSUSESalt Master authentication protocol downgrade may enable minion impersonation7.5 High- Show moreLoading…