Suse Manager vulnerabilities

• libxfont2, suse container suse/kiosk/tigervnc-x11vnc:1.14-63.8, container suse/kiosk/xorg:21.1-83.7 +77 more +79 more fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2 CVE-2026-59679 Fix available 9.2 CriticalAugust 5, 2026
• libxfont, suse container suse/kiosk/tigervnc-x11vnc:1.14-63.8, container suse/kiosk/xorg:21.1-83.7 +77 more +79 more fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2 CVE-2026-44950 Fix available 9.5 CriticalAugust 5, 2026
• suse container suse/sle-micro-rancher/5.3:latest, container suse/sle-micro-rancher/5.4:latest, container suse/sle-micro/5.5:latest +31 more +33 more Missing exit out of permission check in haveged could lead to root exploit CVE-2026-41054 Fix available 7.8 HighMay 19, 2026
• amazon linux, linux kernel, arista cloudvision agni +142 more +144 more crypto: algif_aead - Revert to operating out-of-place CVE-2026-31431 In KEVPublic exploitFix available EPSS 98.1% 7.8 HighApril 22, 2026
• suse container suse/manager/4.3/proxy-httpd:latest, container suse/manager/5.0/x86 64/proxy-httpd:latest, container suse/multi-linux-manager/5.1/x86 64/proxy-httpd:latest +1 more +3 more susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversal CVE-2025-53880 8.7 HighOctober 28, 2025
• suse manager server lts 4.3, container suse manager 5.0 +1 more spacewalk-java has various XSS issues on search page CVE-2025-53883 Fix available 9.3 CriticalOctober 28, 2025
• suse image sles15-sp4-manager-server-4-3-byos, image sles15-sp4-manager-server-4-3-byos-azure, image sles15-sp4-manager-server-4-3-byos-ec2 +3 more +5 more SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint CVE-2025-46811 Public exploit EPSS 13.6% 9.3 CriticalJuly 23, 2025
• suse container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1, image sles15-sp4-manager-proxy-4-3-byos, image sles15-sp4-manager-proxy-4-3-byos-azure +10 more +12 more Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs CVE-2025-46809 6.9 MediumJuly 23, 2025
• suse manager server module 4.3, container suse/manager/5.0/x86 64/server:5.0.4.7.19.1 +1 more Reflected XSS in spacewalk-java CVE-2025-23393 5.6 MediumMay 27, 2025
• suse manager server module 4.3, container suse/manager/5.0/x86 64/server:5.0.4.7.19.1 +1 more Reflected XSS in SystemsController.java in spacewalk-java CVE-2025-23392 Fix available 5.6 MediumApril 16, 2025
• suse manager server 5.0 Database password leaked by systemd uyuni-server-attestation service CVE-2024-22037 Fix available 5.7 MediumNovember 18, 2024
• suse manager server module 4.3, container suse/manager/5.0/x86 64/server:5.0.2.7.8.1 +1 more Reflected XSS in Setup Wizard, Organization Credentials in spacewalk-web CVE-2024-49503 4.6 MediumNovember 18, 2024
• suse manager server module 4.3, container suse/manager/5.0/x86 64/server:5.0.2.7.8.1 +1 more Reflected XSS in Setup Wizard, HTTP Proxy credentials pane in spacewalk-web CVE-2024-49502 4.6 MediumNovember 18, 2024
• suse manager server module 4.3 Insecure handling SSH key in SUSE Manager when bootstrapping new clients CVE-2023-32189 6.4 MediumFebruary 15, 2024
• suse container suse/manager/5.0/x86 64/server:5.0.0-beta1.2.122, opensuse leap 15.5, opensuse tumbleweed +20 more +22 more tomcat packaging allows for escalation to root from tomcat user CVE-2024-22029 Fix available 7.8 HighFebruary 14, 2024
• suse neuvector, manager server +1 more JWT token compromise can allow malicious actions including Remote Code Execution (RCE) CVE-2023-22644 Fix available 9.4 CriticalJune 21, 2023
• service location protocol project location protocol, ietf service location protocol (slp), netapp smi-s provider +3 more +5 more The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to... CVE-2023-29552 In KEV EPSS 64.0% 7.5 HighApril 24, 2023
• opensuse leap 15.3, leap 15.4, rmt-server +3 more +5 more rmt-server-pubcloud allows to escalate from user _rmt to root CVE-2022-31254 Fix available 7.8 HighJanuary 3, 2023
• suse manager server, linux enterprise module for suse manager server 4.2, linux enterprise module for suse manager server 4.3 +2 more +4 more SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do CVE-2022-43754 2.6 LowNovember 4, 2022
• suse manager server, linux enterprise module for suse manager server 4.2, linux enterprise module for suse manager server 4.3 +2 more +4 more SUMA/UYUNI arbitrary file disclosure vulnerability in ScapResultDownload CVE-2022-43753 4.3 MediumNovember 4, 2022
• suse manager server, linux enterprise module for suse manager server 4.2, linux enterprise module for suse manager server 4.3 +2 more +4 more SUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewAction CVE-2022-31255 4.3 MediumNovember 4, 2022
• suse manager server, manager server 4.1, manager server 4.2 +2 more SUMA user enumeration via weak error message CVE-2022-31248 Fix available 5.3 MediumJune 20, 2022
• suse manager server, manager server 4.1, manager server 4.2 +2 more SUMA unauthenticated remote DoS via resource exhaustion CVE-2022-21952 7.5 HighJune 20, 2022
• samba cifs-utils, debian linux, fedoraproject fedora +16 more +18 more In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command... CVE-2022-27239 Fix available 7.8 HighApril 27, 2022
• polkit project polkit, canonical ubuntu linux, oracle http server +27 more +29 more A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec... CVE-2021-4034 In KEVPublic exploitFix available EPSS 94.9% 7.8 HighJanuary 25, 2022
• opensuse factory, leap 15.2, suse arpwatch +3 more +5 more arpwatch: Local privilege escalation from runtime user to root CVE-2021-25321 Fix available 7.8 HighJune 28, 2021
• opensuse cryptctl, suse linux enterprise server for sap 12-sp5, manager server 4.0 +2 more cryptctl: client side password hashing is equivalent to clear text password storage CVE-2019-18906 Fix available 9.8 CriticalJune 23, 2021
• opensuse factory, leap 15.2, suse cups +4 more +6 more cups: ownership of /var/log/cups allows the lp user to create files as root CVE-2021-25317 Fix available 3.3 LowApril 30, 2021
• suse salt-netapi-client, linux enterprise module for suse manager server 4.1, manager server 3.2 +1 more +3 more salt-api is accessible to every user on SUSE Manager Server CVE-2020-8028 Fix available 9.3 CriticalSeptember 16, 2020
• suse manager, uyuni +1 more susemanager installer creates world-readable swap files CVE-2019-3684 Fix available 4.0 MediumMay 13, 2019
• xen, novell suse linux enterprise point of sale, suse linux enterprise server +3 more +5 more Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them,... CVE-2017-7995 Fix available 3.8 LowMay 2, 2017
• ntp, novell suse manager, opensuse leap +6 more +8 more ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash)... CVE-2016-4957 Fix available EPSS 44.9% 7.5 HighJune 13, 2016
• ntp, opensuse leap, opensuse +9 more +11 more ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral... CVE-2016-4953 Fix available EPSS 17.2% 7.5 HighJune 13, 2016
• ntp, novell suse manager, opensuse leap +7 more +9 more ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved... CVE-2016-4956 Fix available EPSS 16.4% 5.3 MediumJune 7, 2016
• ntp, novell suse manager, opensuse leap +7 more +9 more ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a... CVE-2016-4955 Fix available 5.9 MediumJune 7, 2016
• ntp, opensuse leap, opensuse +9 more +11 more The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote... CVE-2016-4954 Fix available EPSS 13.3% 7.5 HighJune 7, 2016
• ibm java sdk, redhat enterprise linux desktop, enterprise linux hpc node supplementary +9 more +11 more Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before... CVE-2016-0264 5.6 MediumMay 13, 2016
• imagemagick, canonical ubuntu linux, opensuse leap +27 more +29 more The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow... CVE-2016-3718 In KEVPublic exploitFix available EPSS 75.6% 5.5 MediumMay 5, 2016
• imagemagick, canonical ubuntu linux, opensuse leap +27 more +29 more The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers... CVE-2016-3715 In KEVPublic exploitFix available EPSS 75.3% 5.5 MediumMay 5, 2016
• oracle jrockit, apache cassandra, canonical ubuntu linux +35 more +37 more Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and... CVE-2016-3427 In KEVFix available EPSS 92.3% 9.8 CriticalApril 21, 2016
• isc bind, canonical ubuntu linux, debian linux +11 more +13 more named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to... CVE-2016-1286 Fix available EPSS 60.8% 8.6 HighMarch 9, 2016
• isc bind, canonical ubuntu linux, debian linux +11 more +13 more named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME... CVE-2016-1285 Fix available EPSS 57.8% 6.8 MediumMarch 9, 2016
• ntp, novell suse openstack cloud, opensuse leap +6 more +8 more The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77... CVE-2015-7976 Fix available 4.3 MediumDecember 31, 2015
• ntp, canonical ubuntu linux, debian linux +16 more +18 more The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the... CVE-2015-5300 Fix available 7.5 HighOctober 22, 2015
• ntp, canonical ubuntu linux, debian linux +13 more +15 more The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions... CVE-2015-5219 Fix available 7.5 HighAugust 25, 2015
• ntp, canonical ubuntu linux, debian linux +10 more +12 more The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote... CVE-2015-5194 Fix available 7.5 HighAugust 25, 2015
• redhat satellite, spacewalk-java, satellite with embedded oracle +2 more +4 more Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red... CVE-2014-3654 Fix available 4.3 MediumNovember 3, 2014
• redhat network satellite, suse manager +1 more XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5... CVE-2014-8162 Fix available 7.5 HighSeptember 29, 2014
• redhat satellite, spacewalk, suse manager +2 more Cross-site scripting (XSS) vulnerability in Spacewalk and Red Hat Network (RHN) Satellite before... CVE-2014-7812 3.5 LowSeptember 29, 2014
• redhat spacewalk, network satellite, suse manager +2 more Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN)... CVE-2014-7811 3.5 LowSeptember 29, 2014
• Show olderLoading…