CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31251 – slurm: %post for slurm-testsuite operates as root in user owned directory
https://notcve.org/view.php?id=CVE-2022-31251
A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE Factory slurm versions prior to 22.05.2-3.3. Una vulnerabilidad de Permisos Incorrectos por Defecto en el empaquetado del testuite slurm de openSUSE Factory permite a atacantes locales con control sobre el usuario slurm escalar a root. Este problema afecta a openSUSE Factory slurm versiones anteriores a 22.05.2-3.3 • https://bugzilla.suse.com/show_bug.cgi?id=1201674 • CWE-276: Incorrect Default Permissions •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2022-21950 – canna: unsafe handling of /tmp/.iroha_unix directory
https://notcve.org/view.php?id=CVE-2022-21950
A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior to canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 canna versions prior to 3.7p3-bp154.3.3.1. openSUSE Factory was also affected. Instead of fixing the package it was deleted there. Una vulnerabilidad de Control de Acceso inapropiado en el servicio systemd de cana en openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 permite a usuarios locales secuestrar el socket de dominio UNIX Este problema afecta a: openSUSE Backports SLE-15-SP3 versiones de canna anteriores a canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 versiones de canna anteriores a 3.7p3-bp154.3.3.1. openSUSE Factory también está afectado. En lugar de arreglar el paquete fue eliminado allí • https://bugzilla.suse.com/show_bug.cgi?id=1199280 • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31250 – keylime %post scriplet allows for privilege escalation from keylime user to root
https://notcve.org/view.php?id=CVE-2022-31250
A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1. Una vulnerabilidad de UNIX Symbolic Link (Symlink) Following en keylime de openSUSE Tumbleweed permite a atacantes locales escalar desde el usuario keylime a root. Este problema afecta a: openSUSE Tumbleweed keylime versiones anteriores a 6.4.2-1.1 • https://bugzilla.suse.com/show_bug.cgi?id=1200885 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21949 – Multiple XXE vulnerabilities in OBS
https://notcve.org/view.php?id=CVE-2022-21949
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13. Una vulnerabilidad de Restricción Inapropiada de Referencia a Entidades externas XML en SUSE Open Build Service permite a atacantes remotos hacer referencia a entidades externas en determinadas operaciones. Esto puede ser usado para conseguir información del servidor que puede ser abusada para escalar a privilegios de administrador en OBS. • https://bugzilla.suse.com/show_bug.cgi?id=1197928 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2022-21946 – suddoers configuration for cscreen not restrictive enough
https://notcve.org/view.php?id=CVE-2022-21946
A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions. Una vulnerabilidad de Administración de Privilegios Inapropiada en la configuración de sudoers en cscreen de openSUSE Factory permite a cualquier usuario local conseguir los privilegios de los grupos tty y dialout y acceder y manipular cualquier seesión de cscreen en ejecución. Este problema afecta a: openSUSE Factory cscreen versión 1.2-1.3 y versiones anteriores • https://bugzilla.suse.com/show_bug.cgi?id=1196451 • CWE-732: Incorrect Permission Assignment for Critical Resource •