Risk | High |
Patch available | YES |
Number of vulnerabilities | 44 |
CVE-ID | CVE-2020-7753 CVE-2021-20178 CVE-2021-20180 CVE-2021-20191 CVE-2021-20228 CVE-2021-3447 CVE-2021-3583 CVE-2021-3620 CVE-2021-36222 CVE-2021-3711 CVE-2021-3807 CVE-2021-3918 CVE-2021-41174 CVE-2021-41244 CVE-2021-43138 CVE-2021-43798 CVE-2021-43813 CVE-2021-43815 CVE-2022-0155 CVE-2022-23552 CVE-2022-27664 CVE-2022-29170 CVE-2022-31097 CVE-2022-31107 CVE-2022-31123 CVE-2022-31130 CVE-2022-32149 CVE-2022-35957 CVE-2022-36062 CVE-2022-39201 CVE-2022-39229 CVE-2022-39306 CVE-2022-39307 CVE-2022-39324 CVE-2022-41715 CVE-2022-41723 CVE-2022-46146 CVE-2023-0507 CVE-2023-0594 CVE-2023-1387 CVE-2023-1410 CVE-2023-2183 CVE-2023-2801 CVE-2023-3128 |
CWE-ID | CWE-185 CWE-532 CWE-94 CWE-209 CWE-476 CWE-119 CWE-20 CWE-79 CWE-863 CWE-22 CWE-200 CWE-287 CWE-347 CWE-400 CWE-288 CWE-264 CWE-451 CWE-836 CWE-862 CWE-662 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #13 is available. |
Vulnerable software |
SUSE Manager Client Tools Beta for SLE Micro Operating systems & Components / Operating system SUSE Manager Client Tools Beta for SLE Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system golang-github-prometheus-prometheus Operating systems & Components / Operating system package or component golang-github-lusitaniae-apache_exporter-debuginfo Operating systems & Components / Operating system package or component python3-uyuni-common-libs Operating systems & Components / Operating system package or component golang-github-boynux-squid_exporter-debuginfo Operating systems & Components / Operating system package or component golang-github-lusitaniae-apache_exporter Operating systems & Components / Operating system package or component prometheus-postgres_exporter Operating systems & Components / Operating system package or component grafana-debuginfo Operating systems & Components / Operating system package or component grafana Operating systems & Components / Operating system package or component golang-github-boynux-squid_exporter Operating systems & Components / Operating system package or component firewalld-prometheus-config Operating systems & Components / Operating system package or component python3-hwdata Operating systems & Components / Operating system package or component python3-spacewalk-client-tools Operating systems & Components / Operating system package or component python3-spacewalk-client-setup Operating systems & Components / Operating system package or component supportutils-plugin-susemanager-client Operating systems & Components / Operating system package or component spacewalk-client-setup Operating systems & Components / Operating system package or component python3-mgr-push Operating systems & Components / Operating system package or component supportutils-plugin-salt Operating systems & Components / Operating system package or component mgr-push Operating systems & Components / Operating system package or component spacecmd Operating systems & Components / Operating system package or component python3-spacewalk-check Operating systems & Components / Operating system package or component ansible Operating systems & Components / Operating system package or component ansible-doc Operating systems & Components / Operating system package or component python3-rhnlib Operating systems & Components / Operating system package or component spacewalk-check Operating systems & Components / Operating system package or component python3-pyvmomi Operating systems & Components / Operating system package or component spacewalk-client-tools Operating systems & Components / Operating system package or component prometheus-blackbox_exporter Operating systems & Components / Operating system package or component golang-github-QubitProducts-exporter_exporter Operating systems & Components / Operating system package or component dracut-saltboot Operating systems & Components / Operating system package or component uyuni-proxy-systemd-services Operating systems & Components / Operating system package or component |
Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 44 vulnerabilities.
EUVDB-ID: #VU65355
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-7753
CWE-ID:
CWE-185 - Incorrect Regular Expression
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU50428
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-20178
CWE-ID:
CWE-532 - Information Exposure Through Log Files
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the snmp_facts module in Ansible discloses 'authkey' and 'privkey' credentials. A local user with access to the output of playbook execution can obtain SNMP credentials.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU50429
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-20180
CWE-ID:
CWE-532 - Information Exposure Through Log Files
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the bitbucket_pipeline_variable module in ansible-collection discloses by default credentials in the console log. A local user can obtain bitbucket_pipeline credentials.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU50936
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-20191
CWE-ID:
CWE-532 - Information Exposure Through Log Files
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU50818
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-20228
CWE-ID:
CWE-532 - Information Exposure Through Log Files
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files in the Ansible Engine|. A local user can read the log files and gain access to sensitive data.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU52984
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-3447
CWE-ID:
CWE-532 - Information Exposure Through Log Files
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files. A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. A local user can read the log files and gain access to sensitive data.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU54626
Risk: High
CVSSv4.0: 6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2021-3583
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation when processing yaml multi-line strings with ansible facts in templates. A remote attacker can trick the victim to open a specially crafted yaml template and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU57422
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-3620
CWE-ID:
CWE-209 - Information Exposure Through an Error Message
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists in the Ansible Engine's ansible-connection module. The Ansible user credentials is disclosed by default in the traceback error message. A remote attacker with ability to intercept traffic can obtain user's credentials.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55287
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-36222
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5). A remote attacker can send a request containing a PA-ENCRYPTED-CHALLENGE padata element without using FAST and perform a denial of service (DoS) attack.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU56063
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2021-3711
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in EVP_PKEY_decrypt() function within implementation of the SM2 decryption. A remote attacker can send specially crafted SM2 content for decryption to trigger a buffer overflow by 62 bytes and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU57967
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-3807
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when matching crafted invalid ANSI escape codes in ansi-regex. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU64034
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2021-3918
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to insufficient sanitization of user-supplied data during the validation of a JSON object. A remote attacker can pass a specially crafted JSON file for validation and execute arbitrary code.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU57926
Risk: Low
CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear]
CVE-ID: CVE-2021-41174
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: Yes
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU64430
Risk: Medium
CVSSv4.0: 2.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U/U:Green]
CVE-ID: CVE-2021-41244
CWE-ID:
CWE-863 - Incorrect Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper access control in fine-grained access control feature. A remote user with an admin role in one organization can list, add, remove, and update users’ roles in other organizations in which he is not an admin.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU62361
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-43138
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to escalate privileges within the application.
The vulnerability exists due to improper input validation when handling data passed via the mapValues()
method. A remote attacker can send a specially crafted request and escalate privileges within the application.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU58647
Risk: High
CVSSv4.0: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/U:Amber]
CVE-ID: CVE-2021-43798
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences, passed after the "/public/plugins/" URL. A remote non-authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU64273
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-43813
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU64404
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-43815
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing .csv files. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU61669
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-0155
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU71567
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-23552
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user with the Editor role can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU67396
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-27664
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63461
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-29170
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to insufficient validation of user-supplied input when processing HTTP Host header during redirection. A remote attacker can perform spoofing attack.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65354
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-31097
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65353
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-31107
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in OAuth implementation routine. A remote attacker can bypass authentication process and login under arbitrary account.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU72128
Risk: Medium
CVSSv4.0: 4.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-31123
CWE-ID:
CWE-347 - Improper Verification of Cryptographic Signature
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the affected instance.
The vulnerability exists due to missing signature verification mechanism. A remote attacker can trick the server admin into installing a malicious plugin even though unsigned plugins are not allowed.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU72130
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-31130
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to the GitLab data source plugin leaks the API key to GitLab. A remote privileged user can expose Grafana authentication token to a third-party.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU68897
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-32149
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to ParseAcceptLanguage does not properly control consumption of internal resources. A remote attacker can send a specially crafted Accept-Language header that will take a significant time to parse and perform a denial of service (DoS) attack.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU68557
Risk: Low
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-35957
CWE-ID:
CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Exploit availability: No
DescriptionThe vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to the way Grafana handles authorization process when Auth proxy authentication is used. A remote user with admin privileges can authenticate as Server Admin by providing the username (or email) in a X-WEBAUTH-USER
HTTP header.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU67646
Risk: Medium
CVSSv4.0: 2.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-36062
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU72131
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-39201
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to Grafana leaks the authentication cookie of users to plugins. A remote user can gain unauthorized access to sensitive information.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU72132
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-39229
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to deny access to the application.
The vulnerability exists due to a logic error in the authentication process, where application allows usage of the same email address by different accounts. A remote user can set an existing email address that belongs to another user as their username and prevent that user from accessing the application.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69484
Risk: Medium
CVSSv4.0: 4.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-39306
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote user can use the invitation link to sign up with an arbitrary username/email with a malicious intent.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69485
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-39307
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application when using the forget password on the login page. A remote attacker can gain unauthorized access to sensitive information on the system.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU71566
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-39324
CWE-ID:
CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to usage of a hidden originalUrl parameter in the shared dashboard. A remote attacker can trick the victim into opening a shared snapshot and click on the button in the Grafana web UI, which will redirect user to an attacker-controlled URL.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU68390
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-41715
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in regexp/syntax when handling regular expressions. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU72686
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-41723
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the HPACK decoder. A remote attacker can send a specially crafted HTTP/2 stream to the application, cause resource exhaustion and perform a denial of service (DoS) attack.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69691
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-46146
CWE-ID:
CWE-836 - Use of Password Hash Instead of Password for Authentication
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to incorrect implementation of basic authentication. A remote attacker with knowledge of the password hash can authenticate against Prometheus without actual knowledge of the password.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75358
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-0507
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within the GeoMap plugin. A remote user with the Editor role can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75359
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-0594
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the trace view visualization. A remote user the Editor role can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU77620
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-1387
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to application allows users to login with a JWT token passed in the URL query parameter auth_token. A remote attacker can intercept the query and gain unauthorized access to the application.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75360
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-1410
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Graphite FunctionDescription tooltip. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU78470
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-2183
CWE-ID:
CWE-862 - Missing Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to missing authorization in the alerts feature within API. A remote user can use the API to send multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU77623
Risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-2801
CWE-ID:
CWE-662 - Improper Synchronization
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect synchronization when processing multiple requests. A remote user can query multiple distinct data sources using mixed queries via public dashboard or API and crash Grafana instances.
MitigationUpdate the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU77652
Risk: High
CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-3128
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in Azure AD OAuth implementation. Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. A remote attacker can modify their profile and provide the email address of an existing Grafana user, bypass authentication process and gain unauthorized access to the application.
The vulnerability affects Grafana installations with Azure AD OAuth configured for a multi-tenant app.
Update the affected package Security Beta update for SUSE Manager Client Tools and Salt to the latest version.
Vulnerable software versionsSUSE Manager Client Tools Beta for SLE Micro: 5
SUSE Manager Client Tools Beta for SLE: 15
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP5
SUSE Linux Enterprise Server 15: SP1 - SP5
SUSE Linux Enterprise Real Time 15: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
openSUSE Leap: 15.3 - 15.5
SUSE Linux Enterprise Server for SAP Applications: 15
golang-github-prometheus-prometheus: before 2.45.0-159000.6.33.1
golang-github-lusitaniae-apache_exporter-debuginfo: before 1.0.0-159000.4.12.1
python3-uyuni-common-libs: before 5.0.1-159000.3.33.1
golang-github-boynux-squid_exporter-debuginfo: before 1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter: before 1.0.0-159000.4.12.1
prometheus-postgres_exporter: before 0.10.1-159000.3.6.1
grafana-debuginfo: before 9.5.8-159000.4.24.1
grafana: before 9.5.8-159000.4.24.1
golang-github-boynux-squid_exporter: before 1.6-159000.4.9.1
firewalld-prometheus-config: before 0.1-159000.6.33.1
python3-hwdata: before 2.3.5-159000.5.13.1
python3-spacewalk-client-tools: before 5.0.1-159000.6.48.1
python3-spacewalk-client-setup: before 5.0.1-159000.6.48.1
supportutils-plugin-susemanager-client: before 5.0.1-159000.6.15.1
spacewalk-client-setup: before 5.0.1-159000.6.48.1
python3-mgr-push: before 5.0.1-159000.4.21.1
supportutils-plugin-salt: before 1.2.2-159000.5.9.1
mgr-push: before 5.0.1-159000.4.21.1
spacecmd: before 5.0.1-159000.6.42.1
python3-spacewalk-check: before 5.0.1-159000.6.48.1
ansible: before 2.9.27-159000.3.9.1
ansible-doc: before 2.9.27-159000.3.9.1
python3-rhnlib: before 5.0.1-159000.6.30.1
spacewalk-check: before 5.0.1-159000.6.48.1
python3-pyvmomi: before 6.7.3-159000.3.6.1
spacewalk-client-tools: before 5.0.1-159000.6.48.1
prometheus-blackbox_exporter: before 0.24.0-159000.3.6.1
golang-github-QubitProducts-exporter_exporter: before 0.4.0-159000.4.6.1
dracut-saltboot: before 0.1.1681904360.84ef141-159000.3.30.1
uyuni-proxy-systemd-services: before 5.0.1-159000.3.9.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20240196-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.