venv-salt-minion vulnerabilities (SUSE)
106 vulnerabilities.
venv-salt-minionSUSESession takeover via Auth Proxy cache key collision7.1 Highvenv-salt-minionSUSESQL Data Source Plugin: OOM DoS via $__timeGroup macro6.5 Mediumvenv-salt-minionSUSEBroken access control in dashboard snapshots6.3 Mediumvenv-salt-minionSUSECVE-2026-17033 CVE Record6.8 Mediumvenv-salt-minionSUSECVE-2026-17183 CVE Record7.1 Highvenv-salt-minionSUSEpip absolute path traversal during download from malicious package indexes5.6 Mediumvenv-salt-minionSUSEkin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default9.1 Criticalvenv-salt-minionSUSECVE-2026-21723 Record5.3 Mediumvenv-salt-minionSUSEInfinite loop on invalid input in golang.org/x/text7.5 Highvenv-salt-minionSUSEStored XSS in the table panel (TableNG)6.8 Mediumvenv-salt-minionSUSEPre-authentication denial of service via the OAuth login route5.3 Mediumvenv-salt-minionSUSEIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations8.7 Highvenv-salt-minionSUSETarfile.extract() doesn't fully respect filter parameter2.0 Lowvenv-salt-minionSUSElxml: javascript: URL bypass in Cleaner via xlink:href8.2 Highvenv-salt-minionSUSEtarfile opened in streaming mode mishandles EOF8.2 Highvenv-salt-minionSUSEConfiguration Injection via Carriage Return (\r) in write() method4.1 Mediumvenv-salt-minionSUSEtarfile extraction filter bypass allows escaping the destination directory7.8 Highvenv-salt-minionSUSEPre-authentication denial of service in the public dashboard query endpoint7.5 Highvenv-salt-minionSUSEStored XSS in the Geomap panel tile-layer attribution7.3 Highvenv-salt-minionSUSEtornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)7.5 Highvenv-salt-minionSUSETornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient7.7 Highvenv-salt-minionSUSEsanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes5.4 Mediumvenv-salt-minionSUSETornado: Out-of-bounds memory access in C extension5.3 Mediumvenv-salt-minionSUSEtarfile.data_filter path traversal bypass allows writing outside the extraction directory6.9 Mediumvenv-salt-minionSUSEPotential DoS via quadratic complexity in unicodedata.normalize()6.3 Mediumvenv-salt-minionSUSEReact Router vulnerable to DoS via unbounded path expansion in __manifest endpoint7.5 Highvenv-salt-minionSUSEReact Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE8.1 Highvenv-salt-minionSUSEReact Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation6.6 Mediumvenv-salt-minionSUSEOpenTelemetry-Go's baggage parsing no longer caps raw header length5.3 Mediumvenv-salt-minionSUSEpip can extract console_scripts and gui_scripts outside installation directory4.1 Mediumvenv-salt-minionSUSEInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix6.9 Mediumvenv-salt-minionSUSEApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`9.3 Criticalvenv-salt-minionSUSEFTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address5.9 Mediumvenv-salt-minionSUSEThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protection6.3 Mediumvenv-salt-minionSUSEurllib3: Sensitive headers forwarded across origins in proxied low-level redirects8.2 Highvenv-salt-minionSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 Highvenv-salt-minionSUSEApache Thrift: c_glib dispatch stack overflow5.3 Mediumvenv-salt-minionSUSESecurity update for python-pyOpenSSLNo scorevenv-salt-minionSUSEpip self-update functionality can import newly installed modules after wheel installation5.3 Mediumvenv-salt-minionSUSEBaseCookie.js_output() does not neutralize embedded characters2.1 Lowvenv-salt-minionSUSElxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files7.5 Highvenv-salt-minionSUSEpip doesn't reject concatenated ZIP and tar archives4.6 Mediumvenv-salt-minionSUSEIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 Highvenv-salt-minionSUSEUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure9.1 Criticalvenv-salt-minionSUSEBase64 decoding stops at first padded quad by default6.0 Mediumvenv-salt-minionSUSEHTTP client proxy tunnel headers not validated for CR/LF5.7 Mediumvenv-salt-minionSUSEOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies5.3 Mediumvenv-salt-minionSUSEpkgutil.get_data() does not enforce documented restrictions0.0 Nonevenv-salt-minionSUSEpyOpenSSL DTLS cookie callback buffer overflow7.2 Highvenv-salt-minionSUSEpyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback1.7 Low- Show moreLoading…