[ Vendor · 45 CVEs ]
Opensuse
CVEs affecting Opensuse published in the last 30 days, plus any Opensuse CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-104617 | 15 Oct 2026 | CVSS 5.1 | SUSE Linux Enterprise Server 16.1There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible… | |
| CVE-2026-104618 | 15 Oct 2026 | CVSS 6.2 | SUSE Linux Enterprise Server 16.1On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however… | |
| CVE-2020-16846 | 6 Nov 2020 | CVSS 9.8 | SaltStack Salt Shell InjectionAn issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in… | Exploited |
| CVE-2020-12641 | 4 May 2020 | CVSS 9.8 | Roundcube Webmail Remote Code Executionrcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for… | ExploitedFix |
| CVE-2020-11651 | 30 Apr 2020 | CVSS 9.8 | SaltStack Salt Authentication BypassAn issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate… | Exploited |
| CVE-2020-11652 | 30 Apr 2020 | CVSS 6.5 | SaltStack Salt Path TraversalAn issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some… | Exploited |
| CVE-2016-4171 | 16 Jun 2016 | CVSS 9.8 | Adobe Flash Player Remote Code ExecutionUnspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as… | Exploited |
| CVE-2016-4117 | 11 May 2016 | CVSS 9.8 | Adobe Flash Player Arbitrary Code ExecutionAdobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May… | Exploited |
| CVE-2016-3714 | 5 May 2016 | CVSS 8.4 | ImageMagick Improper Input ValidationThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1… | ExploitedFix |
| CVE-2016-1646 | 29 Mar 2016 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds ReadThe Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider… | ExploitedFix |
| CVE-2016-0752 | 16 Feb 2016 | CVSS 7.5 | Ruby on Rails Directory TraversalDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x… | Exploited |
| CVE-2015-8651 | 28 Dec 2015 | CVSS 8.8 | Adobe Flash Player Integer OverflowInteger overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux… | ExploitedFix |
| CVE-2015-4902 | 22 Oct 2015 | CVSS 5.3 | Oracle Java SE Integrity CheckUnspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to… | ExploitedFix |
| CVE-2015-7645 | 15 Oct 2015 | CVSS 7.8 | Adobe Flash Player Arbitrary Code ExecutionAdobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote… | ExploitedFix |
| CVE-2015-3246 | 11 Aug 2015 | CVSS 7.4 | Red Hat Libuser Race Conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which… | Exploited |
| CVE-2015-4495 | 8 Aug 2015 | CVSS 8.8 | Mozilla Firefox Security Feature BypassThe PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same… | ExploitedFix |
| CVE-2015-5477 | 29 Jul 2015 | CVSS 7.5 | Crafted TKEY queries crash ISC BIND DNS serversnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and… | ExploitedFix |
| CVE-2015-2590 | 16 Jul 2015 | CVSS 9.8 | Oracle Java SE and Java SE Embedded Remote Code ExecutionUnspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect… | ExploitedFix |
| CVE-2015-5123 | 14 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on… | Exploited |
| CVE-2015-5122 | 14 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on… | Exploited |
| CVE-2015-5119 | 8 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x… | ExploitedFix |
| CVE-2015-3113 | 23 Jun 2015 | CVSS 9.8 | Adobe Flash Player Heap-Based Buffer OverflowHeap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before… | ExploitedFix |
| CVE-2015-3306 | 18 May 2015 | CVSS 10.0 | ProFTPD mod_copy lets anyone copy files on the serverThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | Exploited |
| CVE-2015-3043 | 14 Apr 2015 | CVSS 9.8 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to… | ExploitedFix |
| CVE-2015-0313 | 2 Feb 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before… | ExploitedFix |
| CVE-2014-3153 | 7 Jun 2014 | CVSS 7.8 | Linux Kernel Privilege EscalationThe futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which… | ExploitedFix |
| CVE-2014-0160 | 7 Apr 2014 | CVSS 7.5 | OpenSSL Information DisclosureThe (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote… | ExploitedFix |
| CVE-2013-1690 | 26 Jun 2013 | CVSS 8.8 | Mozilla Firefox and Thunderbird Denial-of-ServiceMozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle… | Exploited |
| CVE-2013-1675 | 16 May 2013 | CVSS 6.5 | Mozilla Firefox Information DisclosureMozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly… | Exploited |
| CVE-2013-2423 | 17 Apr 2013 | CVSS 3.7 | Oracle JRE UnspecifiedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote… | ExploitedFix |
| CVE-2013-0648 | 27 Feb 2013 | CVSS 8.8 | Adobe Flash Player Code ExecutionUnspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171… | ExploitedFix |
| CVE-2013-0640 | 14 Feb 2013 | CVSS 7.8 | Adobe Reader and Acrobat Memory CorruptionAdobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a… | Exploited |
| CVE-2013-0641 | 14 Feb 2013 | CVSS 7.8 | Adobe Reader Buffer OverflowBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute… | Exploited |
| CVE-2013-0422 | 10 Jan 2013 | CVSS 9.8 | Oracle JRE Remote Code ExecutionMultiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public… | Exploited |
| CVE-2012-1535 | 15 Aug 2012 | CVSS 7.8 | Adobe Flash Player Arbitrary Code ExecutionUnspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers… | ExploitedFix |
| CVE-2012-2034 | 9 Jun 2012 | CVSS 7.5 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux… | Exploited |
| CVE-2012-1823 | 11 May 2012 | CVSS 9.8 | PHP-CGI Query String Parametersapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query… | ExploitedFix |
| CVE-2011-0609 | 15 Mar 2011 | CVSS 7.8 | Adobe Flash Player UnspecifiedUnspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android… | Exploited |
| CVE-2010-4344 | 14 Dec 2010 | CVSS 9.8 | Exim Heap-Based Buffer OverflowHeap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an… | ExploitedFix |
| CVE-2010-4345 | 14 Dec 2010 | CVSS 7.8 | Exim Privilege EscalationExim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration… | ExploitedFix |
| CVE-2010-3904 | 6 Dec 2010 | CVSS 7.8 | Linux Kernel Improper Input ValidationThe rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36… | ExploitedFix |
| CVE-2010-1297 | 8 Jun 2010 | CVSS 7.8 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x… | Exploited |
| CVE-2010-0840 | 1 Apr 2010 | CVSS 9.8 | Oracle JRE UnspecifiedUnspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25… | ExploitedFix |
| CVE-2009-3953 | 13 Jan 2010 | CVSS 8.8 | Adobe Acrobat and Reader Universal 3D Remote Code ExecutionThe U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote… | ExploitedFix |
| CVE-2009-4324 | 15 Dec 2009 | CVSS 7.8 | Adobe Acrobat and Reader Use-After-FreeUse-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on… | Exploited |