CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-46163 – travel-support-program vulnerable to data exfiltration via Ransack query injection
https://notcve.org/view.php?id=CVE-2022-46163
Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The travel-support-program uses the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. • https://github.com/openSUSE/travel-support-program/commit/d22916275c51500b4004933ff1b0a69bc807b2b7 https://github.com/openSUSE/travel-support-program/pull/158 https://github.com/openSUSE/travel-support-program/security/advisories/GHSA-2wwv-c6xh-cf68 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31253 – openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself
https://notcve.org/view.php?id=CVE-2022-31253
A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1. Una vulnerabilidad de Ruta de Búsqueda No Confiable en openldap2 de openSUSE Factory permite a atacantes locales con control del usuario o grupo ldap cambiar la propiedad de entradas de directorio arbitrarias a este usuario/grupo, lo que lleva a una escalada a root. Este problema afecta a: versiones de openSUSE Factory openldap2 anteriores a 2.6.3-404.1. • https://bugzilla.suse.com/show_bug.cgi?id=1202931 • CWE-426: Untrusted Search Path •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31256 – sendmail: mail to root privilege escalation via sm-client.pre script
https://notcve.org/view.php?id=CVE-2022-31256
A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1. Una vulnerabilidad de Resolución de Enlaces Inapropiada Antes del Acceso a Archivos ("Enlace Siguiente") en un script llamado por el servicio systemd de sendmail de openSUSE Factory permite a atacantes locales escalar desde el correo de usuario a root. Este problema afecta a: Las versiones de sendmail de SUSE openSUSE Factory anteriores a la 8.17.1-1.1 • https://bugzilla.suse.com/show_bug.cgi?id=1204696 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 4.4EPSS: 0%CPEs: 4EXPL: 0CVE-2022-31252 – permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()
https://notcve.org/view.php?id=CVE-2022-31252
A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225. Una vulnerabilidad de autorización incorrecta en chkstat de SUSE Linux Enterprise Server versión 12-SP5; openSUSE Leap versión 15.3, openSUSE Leap versión 15.4, openSUSE Leap Micro versión 5.2, no tenía en cuenta los componentes de la ruta de escritura del grupo, lo que permitía a atacantes locales con acceso a un grupo lo que puede escribir en una ubicación incluida en la ruta de un binario privilegiado para influir en la resolución de la ruta. Este problema afecta a: SUSE Linux Enterprise Server 12-SP5 versiones de permisos anteriores a 20170707. openSUSE Leap 15.3 versiones de permisos anteriores a 20200127. openSUSE Leap 15.4 versiones de permisos anteriores a 20201225. openSUSE Leap Micro 5.2 versiones de permisos anteriores a 20181225 • https://bugzilla.suse.com/show_bug.cgi?id=1203018 • CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-28321
https://notcve.org/view.php?id=CVE-2022-28321
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream. El paquete Linux-PAM versiones anteriores a 1.5.2-6.1 para openSUSE Tumbleweed, permite omitir la autenticación en los inicios de sesión SSH. • http://download.opensuse.org/source/distribution/openSUSE-current/repo/oss/src https://bugzilla.suse.com/show_bug.cgi?id=1197654 https://www.suse.com/security/cve/CVE-2022-28321.html • CWE-287: Improper Authentication •