rpm package
suse/spacewalk-setup&distro=SUSE Manager Server Module 4.1
pkg:rpm/suse/spacewalk-setup&distro=SUSE%20Manager%20Server%20Module%204.1
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-31248 | — | < 4.1.11-150200.3.18.2 | 4.1.11-150200.3.18.2 | Jun 22, 2022 | A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4. | ||
| CVE-2022-21952 | — | < 4.1.11-150200.3.18.2 | 4.1.11-150200.3.18.2 | Jun 22, 2022 | A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java version | ||
| CVE-2022-26520 | — | < 4.1.11-150200.3.18.2 | 4.1.11-150200.3.18.2 | Mar 7, 2022 | In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP | ||
| CVE-2022-21698 | — | < 4.1.11-150200.3.18.2 | 4.1.11-150200.3.18.2 | Feb 15, 2022 | client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounde | ||
| CVE-2022-21724 | — | < 4.1.11-150200.3.18.2 | 4.1.11-150200.3.18.2 | Feb 2, 2022 | pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin | ||
| CVE-2020-25638 | — | < 4.1.10-3.15.2 | 4.1.10-3.15.2 | Dec 2, 2020 | A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access u | ||
| CVE-2020-8028 | — | < 4.1.6-3.3.2 | 4.1.6-3.3.2 | Sep 17, 2020 | A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root | ||
| CVE-2020-13692 | — | < 4.1.7-3.6.5 | 4.1.7-3.6.5 | Jun 4, 2020 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. |
- CVE-2022-31248Jun 22, 2022affected < 4.1.11-150200.3.18.2fixed 4.1.11-150200.3.18.2
A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.
- CVE-2022-21952Jun 22, 2022affected < 4.1.11-150200.3.18.2fixed 4.1.11-150200.3.18.2
A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java version
- CVE-2022-26520Mar 7, 2022affected < 4.1.11-150200.3.18.2fixed 4.1.11-150200.3.18.2
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP
- CVE-2022-21698Feb 15, 2022affected < 4.1.11-150200.3.18.2fixed 4.1.11-150200.3.18.2
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounde
- CVE-2022-21724Feb 2, 2022affected < 4.1.11-150200.3.18.2fixed 4.1.11-150200.3.18.2
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin
- CVE-2020-25638Dec 2, 2020affected < 4.1.10-3.15.2fixed 4.1.10-3.15.2
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access u
- CVE-2020-8028Sep 17, 2020affected < 4.1.6-3.3.2fixed 4.1.6-3.3.2
A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root
- CVE-2020-13692Jun 4, 2020affected < 4.1.7-3.6.5fixed 4.1.7-3.6.5
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.