CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8018 – User owned /etc in SLES15-SP1-CHOST-BYOS
https://notcve.org/view.php?id=CVE-2020-8018
A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 15 SP1 allows local attackers with the UID 1000 to escalate to root due to a /etc directory owned by the user This issue affects: SUSE Linux Enterprise Server 15 SP1 SLES15-SP1-CAP-Deployment-BYOS version 1.0.1 and prior versions; SLES15-SP1-CHOST-BYOS versions prior to 1.0.3 and prior versions; Una vulnerabilidad de Permisos Predeterminados Incorrectos en las imágenes SLES15-SP1-CHOST-BYOS y SLES15-SP1-CAP-Deployment-BYOS de SUSE Linux Enterprise Server 15 SP1, permite a atacantes locales con el UID 1000 escalar a root debido a un directorio /etc propiedad del usuario Este problema afecta: SUSE Linux Enterprise Server 15 SP1 SLES15-SP1-CAP-Deployment-BYOS versión 1.0.1 y versiones anteriores; SLES15-SP1-CHOST-BYOS versiones anteriores a la versión 1.0.3 y versiones anteriores; • https://bugzilla.suse.com/show_bug.cgi?id=1163813 • CWE-276: Incorrect Default Permissions •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2019-18905 – Deprecated functionality in autoyast2 automatically imports gpg keys without checking them
https://notcve.org/view.php?id=CVE-2019-18905
A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions. Una vulnerabilidad de Verificación Insuficiente de la Autenticidad de Datos en autoyast2 de SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, permite a atacantes remotos conexiones de tipo MITM cuando es usada la funcionalidad obsoleta y no utilizada autoyast para crear imágenes. Este problema afecta a: autoyast2 de SUSE Linux Enterprise Server 12 versión 4.1.9-3.9.1 y versiones anteriores. autoyast2 de SUSE Linux Enterprise Server 15 versión 4.0.70-3.20.1 y versiones anteriores. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00050.html https://bugzilla.suse.com/show_bug.cgi?id=1140711 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 1CVE-2019-18904 – Migrations requests can cause DoS on rmt
https://notcve.org/view.php?id=CVE-2019-18904
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. • https://bugzilla.suse.com/show_bug.cgi?id=1160922 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-17954 – crowbar provision leaks admin password to all nodes in cleartext
https://notcve.org/view.php?id=CVE-2018-17954
An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. • https://bugzilla.suse.com/show_bug.cgi?id=1117080 • CWE-269: Improper Privilege Management •
CVSS: 6.3EPSS: 0%CPEs: 11EXPL: 0CVE-2020-8017 – race condition on texlive-filesystem cron job allows for the deletion of unintended files
https://notcve.org/view.php?id=CVE-2020-8017
A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1. Una vulnerabilidad de Condición de Carrera habilitando un Seguimiento de Enlace en el trabajo de cron enviado con texlive-filesystem del SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1, permite a usuarios locales en el grupo mktex eliminar archivos arbitrarios sobre el sistema. Este problema afecta: texlive-filesystem de SUSE Linux Enterprise Module for Desktop Applications 15-SP1 versiones anteriores a 2017.135-9.5.1. texlive-filesystem de SUSE Linux Enterprise Software Development Kit 12-SP4 versiones anteriores a 2013.74-16.5.1. texlive-filesystem de SUSE Linux Enterprise Software Development Kit 12-SP5 versiones anteriores a 2013.74-16.5.1. texlive-filesystem de openSUSE Leap 15.1 versiones anteriores a 2017.135-lp151.8.3.1. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00021.html https://bugzilla.suse.com/show_bug.cgi?id=1158910 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •