suse/py27-compat-salt&distro=SUSE Manager Server Module 4.1

Vulnerabilities (11)

• CVE-2022-31248Jun 22, 2022
  affected < 3000.3-150200.6.24.2fixed 3000.3-150200.6.24.2

  A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.

• CVE-2022-21952Jun 22, 2022
  affected < 3000.3-150200.6.24.2fixed 3000.3-150200.6.24.2

  A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java version

• CVE-2022-26520Mar 7, 2022
  affected < 3000.3-150200.6.24.2fixed 3000.3-150200.6.24.2

  In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP

• CVE-2022-21698Feb 15, 2022
  affected < 3000.3-150200.6.24.2fixed 3000.3-150200.6.24.2

  client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounde

• CVE-2022-21724Feb 2, 2022
  affected < 3000.3-150200.6.24.2fixed 3000.3-150200.6.24.2

  pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin

• CVE-2021-21996Sep 8, 2021
  affected < 3000.3-6.15.2fixed 3000.3-6.15.2

  An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

• CVE-2021-31607Apr 23, 2021
  affected < 3000.3-6.3.2fixed 3000.3-6.3.2

  In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the s

• CVE-2021-28657Mar 31, 2021
  affected < 3000.3-6.3.2fixed 3000.3-6.3.2

  A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

• CVE-2020-25638Dec 2, 2020
  affected < 3000.3-6.18.1fixed 3000.3-6.18.1

  A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access u

• CVE-2019-5427Apr 22, 2019
  affected < 3000.3-6.21.2fixed 3000.3-6.21.2

  c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

• CVE-2018-20433Dec 24, 2018
  affected < 3000.3-6.21.2fixed 3000.3-6.21.2

  c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.