OP
Product
Opensuse
On CISA KEVExploited in the wildRansomware-linked
1,456
CVEs
45
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 86High 271Medium 142Low 1
Watch
Add Opensuse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-3078 | 5.5 | Sep 21 | The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to… Affected: 11.1; 11.3 |
| CVE-2010-2942 | 5.5 | Sep 21 | The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump… Affected: 11.1; 11.3 |
| CVE-2009-3621 | 5.5 | Oct 22 | net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening… Affected: 11.0; 11.2 |
| CVE-2009-3238 | 5.5 | Sep 18 | The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value,… Affected: 11.0 |
| CVE-2007-6716 | 5.5 | Sep 4 | fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as… Affected: 10.3 |
| CVE-2008-1567 | 5.5 | Mar 31 | phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to… Affected: 10.2; 10.3; 11.0 |
| CVE-2016-2043 | 5.4 | Feb 20 | Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote… Affected: 13.1; 13.2 |
| CVE-2016-2040 | 5.4 | Feb 20 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject… Affected: 13.1; 13.2 |
| CVE-2013-6365 | 5.3 | Nov 5 | Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions Affected: 13.1; 13.2 |
| CVE-2016-5098 | 5.3 | Jul 5 | Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by… Affected: 13.1 |
| CVE-2016-5097 | 5.3 | Jul 5 | phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive… Affected: 13.1 |
| CVE-2016-4956 | 5.3 | Jul 5 | ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet Affected: 13.2 |
| CVE-2016-5730 | 5.3 | Jul 3 | phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value… Affected: 13.1; 13.2 |
| CVE-2016-5104 | 5.3 | Jun 13 | The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on… Affected: 13.2 |
| CVE-2016-1694 | 5.3 | Jun 5 | browser/browsing_data/browsing_data_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote attackers to spoof… Affected: 13.2 |
| CVE-2016-1693 | 5.3 | Jun 5 | browser/safe_browsing/srt_field_trial_win.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows… Affected: 13.2 |
| CVE-2016-1692 | 5.3 | Jun 5 | WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS stylesheets by a ServiceWorker even when… Affected: 13.2 |
| CVE-2016-1670 | 5.3 | May 14 | Race condition in the ResourceDispatcherHostImpl::BeginRequest function in content/browser/loader/resource_dispatcher_host_impl.cc in Google Chrome before 50.0.2661.102 allows… Affected: 13.1 |
| CVE-2016-3119 | 5.3 | Mar 26 | The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through… Affected: 13.2 |
| CVE-2016-2042 | 5.3 | Feb 20 | phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or… Affected: 13.1; 13.2 |
| CVE-2016-2039 | 5.3 | Feb 20 | libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote… Affected: 13.1; 13.2 |
| CVE-2016-2038 | 5.3 | Feb 20 | phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the… Affected: 13.1; 13.2 |
| CVE-2015-8629 | 5.3 | Feb 13 | The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters… Affected: 13.2 |
| CVE-2016-1939 | 5.3 | Jan 31 | Mozilla Firefox before 44.0 stores cookies with names containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie… Affected: 13.1; 13.2 |
| CVE-2015-8792 | 5.3 | Jan 29 | The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML… Affected: 13.1; 13.2 |
| CVE-2016-1494 | 5.3 | Jan 13 | The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a… Affected: 13.1; 13.2 |
| CVE-2015-3195 | 5.3 | Dec 6 | The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors… Affected: 11.4; 13.1; 13.2 |
| CVE-2016-7787 | 4.9 | Dec 23 | A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user Affected: 13.2 |
| CVE-2016-0642 | 4.7 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors… Affected: 13.2 |
| CVE-2016-1947 | 4.7 | Jan 31 | Mozilla Firefox 43.x mishandles attempts to connect to the Application Reputation service, which makes it easier for remote attackers to trigger an unintended download by… Affected: 13.1; 13.2 |
| CVE-2016-1943 | 4.7 | Jan 31 | Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via the scrollTo method Affected: 13.1; 13.2 |
| CVE-2009-1961 | 4.7 | Jun 8 | The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to… Affected: 10.3; 11.1 |
| CVE-2012-2736 | 4.4 | Dec 26 | In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network Affected: 12.1 |
| CVE-2014-2387 | 4.4 | Dec 13 | Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities Affected: 13.1 |
| CVE-2015-7976 | 4.3 | Jan 30 | The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause… Affected: 13.2 |
| CVE-2016-2832 | 4.3 | Jun 13 | Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS) pseudo-classes Affected: 13.1; 13.2 |
| CVE-2016-1664 | 4.3 | May 14 | The HistoryController::UpdateForCommit function in content/renderer/history_controller.cc in Google Chrome before 50.0.2661.94 mishandles the interaction between subframe forward… Affected: 13.1 |
| CVE-2016-1965 | 4.3 | Mar 13 | Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address… Affected: 13.1 |
| CVE-2016-1958 | 4.3 | Mar 13 | browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL Affected: 13.1 |
| CVE-2016-1957 | 4.3 | Mar 13 | Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an… Affected: 13.1; 13.2 |
| CVE-2016-1955 | 4.3 | Mar 13 | Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report… Affected: 13.1; 13.2 |
| CVE-2016-1626 | 4.3 | Feb 14 | The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote… Affected: 13.1 |
The 500 most important CVEs for this product (exploited first, then by severity)