Factory

CVEs (33)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2020-8015	Exim Exim	Hig	0.55	8.4	0.01	Apr 2, 2020	A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.
CVE-2019-18897	OpenSUSE salt-master	Hig	0.55	8.4	0.00	Mar 2, 2020	A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise…
CVE-2021-45082	Cobbler Project Cobbler	Hig	0.51	7.8	0.01	Feb 19, 2022	An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
CVE-2022-21944	OpenSUSE Factory Watchman	Hig	0.51	7.8	0.00	Jan 26, 2022	A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE…
CVE-2021-25321	OpenSUSE Factory	Hig	0.51	7.8	0.00	Jun 30, 2021	A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to…
CVE-2021-25319	OpenSUSE Factory	Hig	0.51	7.8	0.00	May 5, 2021	A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.
CVE-2022-31256	OpenSUSE Factory	Hig	0.50	7.7	0.00	Oct 26, 2022	A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to…
CVE-2019-3699	Privoxy Privoxy	Hig	0.50	7.7	0.00	Jan 24, 2020	UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE…
CVE-2019-3694	OpenSUSE munin	Hig	0.50	7.7	0.00	Jan 24, 2020	A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin to root. This issue affects: openSUSE Factory munin version 2.0.49-4.2 and prior versions. openSUSE Leap 15.1 munin…
CVE-2019-3692	OpenSUSE Leap	Hig	0.50	7.7	0.01	Jan 24, 2020	The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versions. openSUSE…
CVE-2019-3691	OpenSUSE munge	Hig	0.50	7.7	0.01	Jan 23, 2020	A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to…
CVE-2019-18898	OpenSUSE trousers	Hig	0.50	7.7	0.00	Jan 23, 2020	UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions…
CVE-2021-41819	Ruby Lang Ruby	Hig	0.49	7.5	0.03	Jan 1, 2022	CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
CVE-2019-18903	OpenSUSE Leap	Hig	0.49	7.5	0.02	Mar 2, 2020	A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior…
CVE-2019-18902	OpenSUSE Leap	Hig	0.49	7.5	0.02	Mar 2, 2020	A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior…
CVE-2022-31253	OpenSUSE openldap2	Hig	0.46	7.1	0.00	Nov 9, 2022	A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory…
CVE-2021-4166	Vim Vim	Hig	0.46	7.1	0.02	Dec 25, 2021	vim is vulnerable to Out-of-bounds Read
CVE-2021-31997	OpenSUSE python-postorius	Med	0.44	6.8	0.00	Jun 10, 2021	A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin to root. This issue affects: openSUSE Leap 15.2 python-postorius version 1.3.2-lp152.1.2 and prior…
CVE-2021-25322	Python Hyperkitty Project Python Hyperkitty	Med	0.44	6.8	0.00	Jun 10, 2021	A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version…
CVE-2020-8032	OpenSUSE cyrus-sasl	Med	0.44	6.7	0.00	Feb 25, 2021	A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.

CVE-2020-8015HigApr 2, 2020
Exim
Exim
risk 0.55cvss 8.4epss 0.01
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.
CVE-2019-18897HigMar 2, 2020
OpenSUSE
salt-master
risk 0.55cvss 8.4epss 0.00
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise…
CVE-2021-45082HigFeb 19, 2022
Cobbler Project
Cobbler
risk 0.51cvss 7.8epss 0.01
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
CVE-2022-21944HigJan 26, 2022
OpenSUSE
Factory Watchman
risk 0.51cvss 7.8epss 0.00
A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE…
CVE-2021-25321HigJun 30, 2021
OpenSUSE
Factory
risk 0.51cvss 7.8epss 0.00
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to…
CVE-2021-25319HigMay 5, 2021
OpenSUSE
Factory
risk 0.51cvss 7.8epss 0.00
A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.
CVE-2022-31256HigOct 26, 2022
OpenSUSE
Factory
risk 0.50cvss 7.7epss 0.00
A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to…
CVE-2019-3699HigJan 24, 2020
Privoxy
Privoxy
risk 0.50cvss 7.7epss 0.00
UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE…
CVE-2019-3694HigJan 24, 2020
OpenSUSE
munin
risk 0.50cvss 7.7epss 0.00
A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin to root. This issue affects: openSUSE Factory munin version 2.0.49-4.2 and prior versions. openSUSE Leap 15.1 munin…
CVE-2019-3692HigJan 24, 2020
OpenSUSE
Leap
risk 0.50cvss 7.7epss 0.01
The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versions. openSUSE…
CVE-2019-3691HigJan 23, 2020
OpenSUSE
munge
risk 0.50cvss 7.7epss 0.01
A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to…
CVE-2019-18898HigJan 23, 2020
OpenSUSE
trousers
risk 0.50cvss 7.7epss 0.00
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions…
CVE-2021-41819HigJan 1, 2022
Ruby Lang
Ruby
risk 0.49cvss 7.5epss 0.03
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
CVE-2019-18903HigMar 2, 2020
OpenSUSE
Leap
risk 0.49cvss 7.5epss 0.02
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior…
CVE-2019-18902HigMar 2, 2020
OpenSUSE
Leap
risk 0.49cvss 7.5epss 0.02
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior…
CVE-2022-31253HigNov 9, 2022
OpenSUSE
openldap2
risk 0.46cvss 7.1epss 0.00
A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory…
CVE-2021-4166HigDec 25, 2021
Vim
Vim
risk 0.46cvss 7.1epss 0.02
vim is vulnerable to Out-of-bounds Read
CVE-2021-31997MedJun 10, 2021
OpenSUSE
python-postorius
risk 0.44cvss 6.8epss 0.00
A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin to root. This issue affects: openSUSE Leap 15.2 python-postorius version 1.3.2-lp152.1.2 and prior…
CVE-2021-25322MedJun 10, 2021
Python Hyperkitty Project
Python Hyperkitty
risk 0.44cvss 6.8epss 0.00
A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version…
CVE-2020-8032MedFeb 25, 2021
OpenSUSE
cyrus-sasl
risk 0.44cvss 6.7epss 0.00
A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.

Page 1 of 2