CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2022-31254 – rmt-server-pubcloud allows to escalate from user _rmt to root
https://notcve.org/view.php?id=CVE-2022-31254
A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the _rmt user to escalate to root. This issue affects: SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.10. SUSE Linux Enterprise Server for SAP 15-SP1 rmt-server versions prior to 2.10. SUSE Manager Server 4.1 rmt-server versions prior to 2.10. openSUSE Leap 15.3 rmt-server versions prior to 2.10. openSUSE Leap 15.4 rmt-server versions prior to 2.10. • https://bugzilla.suse.com/show_bug.cgi?id=1204285 • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-22643 – libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls
https://notcve.org/view.php?id=CVE-2023-22643
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially crafted REPO_ALIAS, REPO_TYPE or REPO_METADATA_PATH settings to execute code as root. This issue affects: SUSE Linux Enterprise Server for SAP 15-SP3 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. openSUSE Leap 15.4 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. • https://bugzilla.suse.com/show_bug.cgi?id=1206836 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-46163 – travel-support-program vulnerable to data exfiltration via Ransack query injection
https://notcve.org/view.php?id=CVE-2022-46163
Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The travel-support-program uses the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. • https://github.com/openSUSE/travel-support-program/commit/d22916275c51500b4004933ff1b0a69bc807b2b7 https://github.com/openSUSE/travel-support-program/pull/158 https://github.com/openSUSE/travel-support-program/security/advisories/GHSA-2wwv-c6xh-cf68 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31253 – openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself
https://notcve.org/view.php?id=CVE-2022-31253
A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1. Una vulnerabilidad de Ruta de Búsqueda No Confiable en openldap2 de openSUSE Factory permite a atacantes locales con control del usuario o grupo ldap cambiar la propiedad de entradas de directorio arbitrarias a este usuario/grupo, lo que lleva a una escalada a root. Este problema afecta a: versiones de openSUSE Factory openldap2 anteriores a 2.6.3-404.1. • https://bugzilla.suse.com/show_bug.cgi?id=1202931 • CWE-426: Untrusted Search Path •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31256 – sendmail: mail to root privilege escalation via sm-client.pre script
https://notcve.org/view.php?id=CVE-2022-31256
A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1. Una vulnerabilidad de Resolución de Enlaces Inapropiada Antes del Acceso a Archivos ("Enlace Siguiente") en un script llamado por el servicio systemd de sendmail de openSUSE Factory permite a atacantes locales escalar desde el correo de usuario a root. Este problema afecta a: Las versiones de sendmail de SUSE openSUSE Factory anteriores a la 8.17.1-1.1 • https://bugzilla.suse.com/show_bug.cgi?id=1204696 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •