Suse
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Suse product.
RSS Feeds for Suse security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Suse products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Suse Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2025 there have been 27 vulnerabilities in Suse with an average score of 6.9 out of ten. Last year, in 2024 Suse had 8 security vulnerabilities published. That is, 19 more vulnerabilities have already been reported in 2025 as compared to last year. Last year, the average CVE base score was greater by 0.09
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 27 | 6.91 |
| 2024 | 8 | 7.00 |
| 2023 | 20 | 7.84 |
| 2022 | 21 | 7.02 |
| 2021 | 7 | 7.03 |
| 2020 | 28 | 7.05 |
| 2019 | 11 | 7.46 |
| 2018 | 27 | 7.55 |
It may take a day or so for new Suse vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Suse Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2025-62876 | Nov 12, 2025 |
Privilege Escalation via Unnecessary Privileges in lightdm-kde-greeter <6.0.4A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affects lightdm-kde-greeter. before 6.0.4. |
Opensuse
|
| CVE-2025-53883 | Oct 30, 2025 |
Reflected XSS in SUSE Manager Server <5.0.28 / <4.3.88A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5. |
Container Suse Manager 5 0
Suse Manager Server Lts 4 3
|
| CVE-2025-53880 | Oct 30, 2025 |
tftpsync Path Traversal Write/Del via TFTP Scripts (CVE-2025-53880)A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses. |
Manager
|
| CVE-2025-54471 | Oct 30, 2025 |
NeuVector Hard-Coded Key in Source Enables Config Encryption DisclosureNeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data. |
Neuvector
|
| CVE-2025-54469 | Oct 30, 2025 |
NeuVector Enforcer Command Injection via Unsanitized CLUSTER_* PortsA vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active. The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT are used directly to compose shell commands via popen without validation or sanitization. This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container. |
Neuvector
|
| CVE-2025-54470 | Oct 30, 2025 |
NeuVector TLS Cert Verification Bypass in Anonymous Telemetry (MITM/DoS)This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server. In affected versions, NeuVector does not enforce TLS certificate verification when transmitting anonymous cluster data to the telemetry server. As a result, the communication channel is susceptible to man-in-the-middle (MITM) attacks, where an attacker could intercept or modify the transmitted data. Additionally, NeuVector loads the response of the telemetry server is loaded into memory without size limitation, which makes it vulnerable to a Denial of Service(DoS) attack |
Neuvector
|
| CVE-2024-58269 | Oct 29, 2025 |
CVE-2024-58269: Rancher Manager audit log data exposureA vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs. |
Rancher
|
| CVE-2023-32199 | Oct 29, 2025 |
Rancher Manager: Removing GlobalRole Leaves Admin AccessA vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs |
Rancher
|
| CVE-2024-58260 | Oct 02, 2025 |
Rancher Manager: Missing Validation on .username Field Causes Denial of AccessA vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts. |
Rancher
|
| CVE-2024-58267 | Oct 02, 2025 |
Rancher Manager CLI SAML Phishing VulnerabilityA vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Ranchers authentication tokens. |
Rancher
|
| CVE-2025-54468 | Oct 02, 2025 |
Rancher Manager Header Leak via /meta/proxy (Impersonate-Extra-*)A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses. |
Rancher
|
| CVE-2025-8077 | Sep 17, 2025 |
NeuVector <5.4.5 Default admin password exposes full API accessA vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs. |
Neuvector
|
| CVE-2025-54467 | Sep 17, 2025 |
NeuVector Process Rule Violation Logs Expose PasswordsWhen a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log. |
Neuvector
|
| CVE-2025-53884 | Sep 17, 2025 |
NeuVector unsalted hash vulnerable to rainbow table attacksNeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed). |
Neuvector
|
| CVE-2025-46811 | Jul 30, 2025 |
SUSE Manager RCE via /rhn/websocket/minion/remote-commands before 5.0.14A Missing Authentication for Critical Function vulnerability in SUSE Manager allows anyone with access to the websocket at /rhn/websocket/minion/remote-commands to execute arbitrary commands as root. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 0.3.7-150600.3.6.2; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 0.3.7-150400.3.39.4; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2. |
Manager
|
| CVE-2025-32463 | Jun 30, 2025 |
Sudo <1.9.17p1 LPE via chroot /etc/nsswitch.confSudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. |
Linux Enterprise Real Time
Linux Enterprise Desktop
Linux Enterprise Server Sap
And others... |
| CVE-2023-32197 | Apr 16, 2025 |
Rancher RoleTemplate Priv Esc (external=true) <2.7.14, <2.8.5A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific scenarios.This issue affects rancher: from 2.7.0 before 2.7.14, from 2.8.0 before 2.8.5. |
Rancher
|
| CVE-2024-52281 | Apr 16, 2025 |
Stored XSS via Cluster Description Field in SUSE Rancher 2.9.0-2.9.3A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4. |
Rancher
|
| CVE-2024-52280 | Apr 11, 2025 |
Rancher Underspecified Access via Generic PermissionsA Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to access, when they have at least some generic permissions on the type. This issue affects rancher: before 2175e09, before 6e30359, before c744f0b. |
Rancher
|
| CVE-2024-52282 | Apr 11, 2025 |
SUSE Rancher 2.8.x/2.9.x Sensitive Info Leak in Apps Catalog (CVE-2024-52282)A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Catalog to read any sensitive information that are contained within the Apps values. Additionally, the same information leaks into auditing logs when the audit level is set to equal or above 2. This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4. |
Rancher
|
| CVE-2025-23387 | Apr 11, 2025 |
SUSE Rancher 2.8-2.10: Unauth CLI Token ExposureA Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3. |
Rancher
|
| CVE-2025-23388 | Apr 11, 2025 |
Stack Overflow in SUSE Rancher 2.8.0-2.8.12 DoSA Stack-based Buffer Overflow vulnerability in SUSE rancher allows for denial of service.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3. |
Rancher
|
| CVE-2025-23389 | Apr 11, 2025 |
Improper Access Control in SUSE Rancher <2.8.13, <2.9.7, <2.10.3 via SAMLA Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3. |
Rancher
|
| CVE-2025-23391 | Apr 11, 2025 |
Rancher <2.8.14,<2.9.8,<2.10.4 PrivEsc: Restricted Admin Password ResetA Incorrect Privilege Assignment vulnerability in SUSE rancher allows a Restricted Administrator to change the password of Administrators and take over their accounts. This issue affects rancher: from 2.8.0 before 2.8.14, from 2.9.0 before 2.9.8, from 2.10.0 before 2.10.4. |
Rancher
|
| CVE-2024-12087 | Jan 14, 2025 |
Path traversal in rsync via --inc-recursive optionA path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client. |
Suse Linux
|
| CVE-2024-12085 | Jan 14, 2025 |
Rsync: Checksum Length Manipulation Enables Stack Data LeakA flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. |
Suse Linux
|
| CVE-2024-12086 | Jan 14, 2025 |
Rsync Server Remote File Enumeration via Checksum ExploitA flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. |
Suse Linux
|
| CVE-2022-45157 | Nov 13, 2024 |
Rancher vSphere CPI and CSI Credential Storage VulnerabilityA vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments. |
Rancher
|
| CVE-2024-46956 | Nov 10, 2024 |
Ghostscript 10.03 Out-of-Bounds AccessAn issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution. |
Linux Enterprise High Performance Computing
Linux Enterprise Server
Linux Enterprise Server Sap
And others... |
| CVE-2024-46953 | Nov 10, 2024 |
Ghostscript 10.03 Path Traversal OverflowAn issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution. |
Linux Enterprise High Performance Computing
Linux Enterprise Server
Linux Enterprise Server Sap
And others... |
| CVE-2024-46955 | Nov 10, 2024 |
Ghostscript 10.03 Indexed Color OOB ReadAn issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space. |
Linux Enterprise High Performance Computing
Linux Enterprise Server
Linux Enterprise Server Sap
And others... |
| CVE-2024-46951 | Nov 10, 2024 |
Ghostscript 10.03 Pattern Color Space RCEAn issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution. |
Linux Enterprise High Performance Computing
Linux Enterprise Server
Linux Enterprise Server Sap
And others... |
| CVE-2023-22649 | Oct 16, 2024 |
Rancher Audit Log Sensitive Data LeakA vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue. |
Rancher
|
| CVE-2024-6387 | Jul 01, 2024 |
OpenSSH Race Condition leading to RCE, known as regreSSHionA security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. |
Linux Enterprise Micro
|
| CVE-2024-23301 | Jan 12, 2024 |
World-readable initrd via GRUB_RESCUE=y in ReaR <=2.7Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root. |
Linux Enterprise
|
| CVE-2020-10676 | Dec 12, 2023 |
CVE-2020-10676: Unauth Namespace Relocation in Rancher 2.x <2.6.13/2.7.4In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project. |
Rancher
|
| CVE-2023-22644 | Sep 20, 2023 |
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API accessA user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. |
Manager Server
|
| CVE-2023-32182 | Sep 19, 2023 |
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfixA Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1. |
Suse Linux Enterprise Desktop
Linux Enterprise High Performance Computing
|
| CVE-2023-32186 | Sep 19, 2023 |
A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1. |
Rancher Rke2
|
| CVE-2023-22647 | Jun 01, 2023 |
An Improper Privilege Management vulnerability in SUSE RancherAn Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster. This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4. |
Rancher
|
| CVE-2023-22648 | Jun 01, 2023 |
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UIA Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4. |
Rancher
|
| CVE-2022-43760 | Jun 01, 2023 |
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject codeAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an administrator, once an administrator opens the affected web page. This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4. |
Rancher
|
| CVE-2023-34256 | May 31, 2023 |
An issue was discovered in the Linux kernel before 6.3.3An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access. |
Linux Enterprise
|
| CVE-2023-22651 | May 04, 2023 |
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege EscalationImproper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks before resources are admitted into the Kubernetes cluster. The issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did not follow an upgrade path) are not affected. |
Rancher
|
| CVE-2023-29552 | Apr 25, 2023 |
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary servicesThe Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor. |
Linux Enterprise Server
Manager Server
|
| CVE-2022-45155 | Mar 15, 2023 |
An Improper Handling of Exceptional Conditions vulnerability in obs-service-go_modules of openSUSE Factory allows attackersAn Improper Handling of Exceptional Conditions vulnerability in obs-service-go_modules of openSUSE Factory allows attackers that can influence the call to the service to delete files and directories on the system of the victim. This issue affects: SUSE openSUSE Factory obs-service-go_modules versions prior to 0.6.1. |
Opensuse Factory
|
| CVE-2023-23005 | Mar 01, 2023 |
In the Linux kernel before 6.2In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached. |
Linux Enterprise Server
|
| CVE-2022-45153 | Feb 15, 2023 |
An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configurationAn Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. |
Linux Enterprise Server
Linux Enterprise Module Sap Applications
|
| CVE-2022-21953 | Feb 07, 2023 |
A Missing Authorization vulnerability in of SUSE RancherA Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1. |
Rancher
|
| CVE-2022-43755 | Feb 07, 2023 |
A Insufficient Entropy vulnerability in SUSE Rancher allows attackersA Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1. |
Rancher
|