govulncheck-vulndb vulnerabilities (openSUSE)
2,654 vulnerabilities.
govulncheck-vulndbopenSUSEBypass of meta content URL escaping causes XSS in html/template6.1 Mediumgovulncheck-vulndbopenSUSEQuadratic string concatentation in consumeComment in net/mail7.5 Highgovulncheck-vulndbopenSUSEInvoking "go bug" follows symlinks in predictable temporary filenames in cmd/go5.3 Mediumgovulncheck-vulndbopenSUSEInvoking "go tool pack" does not sanitize output paths in cmd/go5.9 Mediumgovulncheck-vulndbopenSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 Highgovulncheck-vulndbopenSUSECrash when handling long CNAME response in net7.5 Highgovulncheck-vulndbopenSUSEgittuf: Policy can be rolled back to prior valid version4.9 Mediumgovulncheck-vulndbopenSUSEFileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion9.1 Criticalgovulncheck-vulndbopenSUSEetcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks0.0 Nonegovulncheck-vulndbopenSUSEShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check6.5 Mediumgovulncheck-vulndbopenSUSEKubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users6.5 Mediumgovulncheck-vulndbopenSUSEfree5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm7.7 Highgovulncheck-vulndbopenSUSEgo-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth6.2 Mediumgovulncheck-vulndbopenSUSEfree5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI8.2 Highgovulncheck-vulndbopenSUSEfree5GC: Missing Concurrent NAS SMC Validation During NGAP Handover3.7 Lowgovulncheck-vulndbopenSUSEfree5GC: UE Security Capability bypass on NGAP PathSwitchRequest6.1 Mediumgovulncheck-vulndbopenSUSEKiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect7.0 Highgovulncheck-vulndbopenSUSEHelm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering9.9 Criticalgovulncheck-vulndbopenSUSERancher Extensions have arbitrary file access via path traversal8.4 Highgovulncheck-vulndbopenSUSEGotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme5.9 Mediumgovulncheck-vulndbopenSUSEGotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook9.4 Criticalgovulncheck-vulndbopenSUSEGotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine7.5 Highgovulncheck-vulndbopenSUSEGotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes5.3 Mediumgovulncheck-vulndbopenSUSEGotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes5.3 Mediumgovulncheck-vulndbopenSUSEGotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v88.2 Highgovulncheck-vulndbopenSUSEGotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist8.2 Highgovulncheck-vulndbopenSUSEGotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection9.8 Criticalgovulncheck-vulndbopenSUSEShellHub: Crash-DoS via field injection in filter and sort-by parameters5.4 Mediumgovulncheck-vulndbopenSUSEShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data6.5 Mediumgovulncheck-vulndbopenSUSEShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace6.5 Mediumgovulncheck-vulndbopenSUSEazureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay8.1 Highgovulncheck-vulndbopenSUSEKyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component6.1 Mediumgovulncheck-vulndbopenSUSEDaptin fuzzy search injects unvalidated column name into raw SQL7.1 Highgovulncheck-vulndbopenSUSEHatchet: Cross-tenant information disclosure in `listTasksByDAGIds`5.3 Mediumgovulncheck-vulndbopenSUSEHugo: Node tool execution allows file system access outside the project directory6.2 Mediumgovulncheck-vulndbopenSUSEHarvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS8.6 Highgovulncheck-vulndbopenSUSENew API: SSRF Filter Bypass via 0.0.0.07.1 Highgovulncheck-vulndbopenSUSEDevSpace UI Server WebSocket CheckOrigin does not validate source7.7 Highgovulncheck-vulndbopenSUSEHTTP Filestore Endpoints Misapply Permissions Across Organizations6.8 Mediumgovulncheck-vulndbopenSUSEVelociraptor EVTX Parser — Process Crash via Crafted .evtx File4.4 Mediumgovulncheck-vulndbopenSUSEGetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations5.0 Mediumgovulncheck-vulndbopenSUSEPrometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI5.1 Mediumgovulncheck-vulndbopenSUSEKubewarden: RBAC Reconnaissance via unchecked can_i host capability call4.3 Mediumgovulncheck-vulndbopenSUSEPocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade6.1 Mediumgovulncheck-vulndbopenSUSEDevGuard: Unauthenticated identity assertion via `X-Admin-Token` header9.3 Criticalgovulncheck-vulndbopenSUSEGoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)7.5 Highgovulncheck-vulndbopenSUSEFiber: XSS in AutoFormat Content Negotiation5.3 Mediumgovulncheck-vulndbopenSUSEMinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint6.9 Mediumgovulncheck-vulndbopenSUSEOpenBao's Namespace Deletion May Not Delete Data Properly2.3 Lowgovulncheck-vulndbopenSUSEoxyno-zeta/s3-proxy: Security Issues in Resource Path Matching9.4 Critical- Show moreLoading…