CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-18901 – mysql-systemd-helper allows setting 640 permissions of arbitrary files
https://notcve.org/view.php?id=CVE-2019-18901
A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1. Una vulnerabilidad de tipo Symbolic Link (Symlink) Following en mysql-systemd-helper del paquete mariadb de SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, permite a atacantes locales cambiar los permisos de archivos arbitrarios a 0640. Este problema afecta a: mariadb de SUSE Linux Enterprise Server 12 versiones anteriores a 10.2.31-3.25.1. mariadb de SUSE Linux Enterprise Server 15 versiones anteriores a 10.2.31-3.26.1. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00007.html https://bugzilla.suse.com/show_bug.cgi?id=1160895 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 8.4EPSS: 0%CPEs: 3EXPL: 0CVE-2019-18897 – Local privilege escalation from user salt to root
https://notcve.org/view.php?id=CVE-2019-18897
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions. Una vulnerabilidad de tipo Symbolic Link (Symlink) Following en el empaquetado de la sal de SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory, permite a atacantes locales escalar los privilegios de la sal de user a root. Este problema afecta a: salt-master de SUSE Linux Enterprise Server 12 versión 2019.2.0-46.83.1 y versiones anteriores. salt-master de SUSE Linux Enterprise Server 15 versión 2019.2.0-6.21.1 y versiones anteriores. salt-master de OpenSUSE Factory versión 2019.2.2-3.1 y versiones anteriores. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html https://bugzilla.suse.com/show_bug.cgi?id=1157465 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 4.9EPSS: 0%CPEs: 4EXPL: 1CVE-2019-15624
https://notcve.org/view.php?id=CVE-2019-15624
Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders. Una Comprobación de Entrada Inapropiada en Nextcloud Server versión 15.0.7, permite a los administradores de grupo crear usuarios con los ID de carpetas del sistema. • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html https://hackerone.com/reports/508493 https://nextcloud.com/security/advisory/?id=NC-SA-2019-015 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-20105 – yast2-rmt exposes CA private key passhrase in log-file
https://notcve.org/view.php?id=CVE-2018-20105
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2. Una Inclusión de Información Confidencial en una vulnerabilidad de Archivos de Registro en yast2-rmt de SUSE Linux Enterprise Server versión 15; openSUSE Leap, permite a atacantes locales aprender la contraseña si pueden acceder al archivo de registro. Este problema afecta: yast2-rmt versiones anteriores a 1.2.2 de SUSE Linux Enterprise Server 15 . yast2-rmt versiones anteriores a 1.2.2 de openSUSE Leap. • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00015.html https://bugzilla.suse.com/show_bug.cgi?id=1119835 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-12476 – obs-service-extract_file's outfilename parameter allows to write files outside of package directory
https://notcve.org/view.php?id=CVE-2018-12476
Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74. Una vulnerabilidad de Salto de Ruta Relativa en obs-service-tar_scm de SUSE Linux Enterprise Server versión 15; openSUSE Factory, permite a atacantes remotos con control sobre un repositorio sobrescribir archivos en la máquina del usuario local si un servicio malicioso es ejecutado. Este problema afecta a: obs-service-tar_scm versiones anteriores a 0.9.2.1537788075.fefaa74 de SUSE Linux Enterprise Server versión 15. obs-service-tar_scm versiones anteriores a 0.9.2.1537788075.fefaa74 de openSUSE Factory. • https://bugzilla.suse.com/show_bug.cgi?id=1107944 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •