govulncheck-vulndb vulnerabilities (openSUSE)
2,654 vulnerabilities.
govulncheck-vulndbopenSUSEGokapi: Data Leak in Upload Status Stream6.4 Mediumgovulncheck-vulndbopenSUSEGogs: Cross-repository LFS object overwrite via missing content hash verification9.3 Criticalgovulncheck-vulndbopenSUSEGogs: Stored XSS via data URI in issue comments8.7 Highgovulncheck-vulndbopenSUSENginx UI: Unauthenticated Backup Download with Encryption Key Disclosure9.8 Criticalgovulncheck-vulndbopenSUSESliver: Authenticated Nil-Pointer Dereference in Handlers2.1 Lowgovulncheck-vulndbopenSUSEZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover7.7 Highgovulncheck-vulndbopenSUSEZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V28.2 Highgovulncheck-vulndbopenSUSEZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint9.3 Criticalgovulncheck-vulndbopenSUSEFile Browser: TUS Delete Endpoint Bypasses Delete Permission Check9.1 Criticalgovulncheck-vulndbopenSUSENetmaker: Denial of Service via Server Shutdown Endpoint8.7 Highgovulncheck-vulndbopenSUSESiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution9.3 Criticalgovulncheck-vulndbopenSUSETraefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)7.5 Highgovulncheck-vulndbopenSUSENuclio Shell Runtime Command Injection Leading to Privilege Escalation8.9 Highgovulncheck-vulndbopenSUSETraefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)7.5 Highgovulncheck-vulndbopenSUSETraefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)4.4 Mediumgovulncheck-vulndbopenSUSEDocker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.0 Highgovulncheck-vulndbopenSUSESiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access5.7 Mediumgovulncheck-vulndbopenSUSERancher Backup Operator pod's logs leak S3 tokens6.8 Mediumgovulncheck-vulndbopenSUSEAuthorization Bypass in LXD GET /1.0/certificates Endpoint2.1 Lowgovulncheck-vulndbopenSUSEmelange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI4.3 Mediumgovulncheck-vulndbopenSUSEOliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login7.5 Highgovulncheck-vulndbopenSUSEOliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling7.5 Highgovulncheck-vulndbopenSUSEFile Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory7.1 Highgovulncheck-vulndbopenSUSEOliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint7.5 Highgovulncheck-vulndbopenSUSEmalcontent's nested archive extraction failure can drop content from scan inputs6.9 Mediumgovulncheck-vulndbopenSUSEkaniko has tar archive path traversal in build context extraction allows writing files outside destination directory8.2 Highgovulncheck-vulndbopenSUSEVikunja Vulnerable to Account Takeover via Password Reset Token Reuse9.8 Criticalgovulncheck-vulndbopenSUSEBeszel Vulnerable to Docker API Path Traversal via Unsanitized Container ID6.5 Mediumgovulncheck-vulndbopenSUSE`osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query List6.1 Mediumgovulncheck-vulndbopenSUSE`osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration7.4 Highgovulncheck-vulndbopenSUSESending certain HTTP/2 frames can cause a server to panic in golang.org/x/net7.5 Highgovulncheck-vulndbopenSUSEFleet: Sensitive Google Calendar credentials disclosed to low-privileged users1.3 Lowgovulncheck-vulndbopenSUSEFleet: Authorization Bypass in certificate template batch deletion for team administrators1.2 Lowgovulncheck-vulndbopenSUSEFleet: Device lock PIN can be predicted if lock time is known0.6 Lowgovulncheck-vulndbopenSUSEFleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint1.7 Lowgovulncheck-vulndbopenSUSEVitess users with backup storage access can write to arbitrary file paths on restore9.3 Criticalgovulncheck-vulndbopenSUSEVitess users with backup storage access can gain unauthorized access to production deployment environments8.4 Highgovulncheck-vulndbopenSUSETerraform Provider Debug Logs Vulnerable to Sensitive Information Exposure5.0 Mediumgovulncheck-vulndbopenSUSEWireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-Update8.8 Highgovulncheck-vulndbopenSUSEsealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations4.9 Mediumgovulncheck-vulndbopenSUSEMCP Go SDK Vulnerable to Improper Handling of Case Sensitivity7.0 Highgovulncheck-vulndbopenSUSEZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API8.2 Highgovulncheck-vulndbopenSUSEZITADEL has potential SSRF via Actions2.1 Lowgovulncheck-vulndbopenSUSEZITADEL's truncated opaque tokens are still valid4.3 Mediumgovulncheck-vulndbopenSUSEFleet has a SQL injection via backtick escape in ORDER BY parameter5.1 Mediumgovulncheck-vulndbopenSUSEMailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API5.8 Mediumgovulncheck-vulndbopenSUSEVikunja has Path Traversal in CLI Restore7.2 Highgovulncheck-vulndbopenSUSEVikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure7.3 Highgovulncheck-vulndbopenSUSEVijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change9.1 Criticalgovulncheck-vulndbopenSUSEVikunja has Reflected HTML Injection via filter Parameter in Projects Module6.1 Medium- Show moreLoading…