rpm package
suse/supportutils-plugin-susemanager-client&distro=SUSE Manager Client Tools 15
pkg:rpm/suse/supportutils-plugin-susemanager-client&distro=SUSE%20Manager%20Client%20Tools%2015
Vulnerabilities (18)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-11065 | Med | 5.3 | < 5.0.5-150000.3.30.1 | 5.0.5-150000.3.30.1 | Jan 26, 2026 | A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data process | |
| CVE-2025-6197 | Med | 4.2 | < 5.0.5-150000.3.30.1 | 5.0.5-150000.3.30.1 | Jul 18, 2025 | An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL | |
| CVE-2025-6023 | Hig | 7.6 | < 5.0.5-150000.3.30.1 | 5.0.5-150000.3.30.1 | Jul 18, 2025 | An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+sec | |
| CVE-2025-3415 | Med | 4.3 | < 5.0.5-150000.3.30.1 | 5.0.5-150000.3.30.1 | Jul 17, 2025 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+ | |
| CVE-2024-45337 | Cri | 9.1 | < 5.0.4-150000.3.27.1 | 5.0.4-150000.3.27.1 | Dec 12, 2024 | Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that | |
| CVE-2024-22037 | Med | 5.5 | < 5.0.4-150000.3.27.1 | 5.0.4-150000.3.27.1 | Nov 28, 2024 | The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users. | |
| CVE-2024-51744 | Low | 3.1 | < 5.0.4-150000.3.27.1 | 5.0.4-150000.3.27.1 | Nov 4, 2024 | golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors r | |
| CVE-2024-8118 | Med | — | < 5.0.4-150000.3.27.1 | 5.0.4-150000.3.27.1 | Sep 26, 2024 | In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules. | |
| CVE-2023-6152 | — | < 5.0.4-150000.3.27.1 | 5.0.4-150000.3.27.1 | Feb 13, 2024 | A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. | ||
| CVE-2023-29409 | — | < 4.3.3-150000.3.21.2 | 4.3.3-150000.3.21.2 | Aug 2, 2023 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr | ||
| CVE-2023-3128 | — | < 5.0.4-150000.3.27.1 | 5.0.4-150000.3.27.1 | Jun 22, 2023 | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. | ||
| CVE-2022-41723 | — | < 4.3.3-150000.3.21.2 | 4.3.3-150000.3.21.2 | Feb 28, 2023 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. | ||
| CVE-2022-46146 | — | < 4.3.3-150000.3.21.2 | 4.3.3-150000.3.21.2 | Nov 29, 2022 | Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0. | ||
| CVE-2022-32149 | — | < 4.3.3-150000.3.21.2 | 4.3.3-150000.3.21.2 | Oct 14, 2022 | An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. | ||
| CVE-2020-13379 | — | < 4.1.2-3.9.2 | 4.1.2-3.9.2 | Jun 3, 2020 | The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information abo | ||
| CVE-2020-12245 | — | < 4.1.2-3.9.2 | 4.1.2-3.9.2 | Apr 24, 2020 | Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. | ||
| CVE-2019-10215 | — | < 4.1.2-3.9.2 | 4.1.2-3.9.2 | Oct 8, 2019 | Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser. | ||
| CVE-2019-15043 | — | < 4.1.2-3.9.2 | 4.1.2-3.9.2 | Sep 3, 2019 | In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana. |
- affected < 5.0.5-150000.3.30.1fixed 5.0.5-150000.3.30.1
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data process
- affected < 5.0.5-150000.3.30.1fixed 5.0.5-150000.3.30.1
An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL
- affected < 5.0.5-150000.3.30.1fixed 5.0.5-150000.3.30.1
An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+sec
- affected < 5.0.5-150000.3.30.1fixed 5.0.5-150000.3.30.1
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+
- affected < 5.0.4-150000.3.27.1fixed 5.0.4-150000.3.27.1
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that
- affected < 5.0.4-150000.3.27.1fixed 5.0.4-150000.3.27.1
The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users.
- affected < 5.0.4-150000.3.27.1fixed 5.0.4-150000.3.27.1
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors r
- affected < 5.0.4-150000.3.27.1fixed 5.0.4-150000.3.27.1
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
- CVE-2023-6152Feb 13, 2024affected < 5.0.4-150000.3.27.1fixed 5.0.4-150000.3.27.1
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
- CVE-2023-29409Aug 2, 2023affected < 4.3.3-150000.3.21.2fixed 4.3.3-150000.3.21.2
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr
- CVE-2023-3128Jun 22, 2023affected < 5.0.4-150000.3.27.1fixed 5.0.4-150000.3.27.1
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
- CVE-2022-41723Feb 28, 2023affected < 4.3.3-150000.3.21.2fixed 4.3.3-150000.3.21.2
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
- CVE-2022-46146Nov 29, 2022affected < 4.3.3-150000.3.21.2fixed 4.3.3-150000.3.21.2
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.
- CVE-2022-32149Oct 14, 2022affected < 4.3.3-150000.3.21.2fixed 4.3.3-150000.3.21.2
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
- CVE-2020-13379Jun 3, 2020affected < 4.1.2-3.9.2fixed 4.1.2-3.9.2
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information abo
- CVE-2020-12245Apr 24, 2020affected < 4.1.2-3.9.2fixed 4.1.2-3.9.2
Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
- CVE-2019-10215Oct 8, 2019affected < 4.1.2-3.9.2fixed 4.1.2-3.9.2
Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser.
- CVE-2019-15043Sep 3, 2019affected < 4.1.2-3.9.2fixed 4.1.2-3.9.2
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.