Suse Manager vulnerabilities

22 CVEs affecting Suse Manager, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-3684, published 2019-05-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.7% chance of exploitation in the next 30 days. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.3% chance of exploitation in the next 30 days. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2015-2808, published 2015-04-01. Low severity, CVSS 3.7. EPSS: 73.9% chance of exploitation in the next 30 days. The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to…
CVE-2016-1286, published 2016-03-09. High severity, CVSS 8.6. EPSS: 62.1% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME…
CVE-2016-1285, published 2016-03-09. Medium severity, CVSS 6.8. EPSS: 59.1% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service…
CVE-2016-4953, published 2016-07-05. High severity, CVSS 7.5. EPSS: 17.2% chance of exploitation in the next 30 days. ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at…
CVE-2016-4954, published 2016-07-05. High severity, CVSS 7.5. EPSS: 13.3% chance of exploitation in the next 30 days. The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many…
CVE-2015-5300, published 2017-07-21. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to…
CVE-2015-5194, published 2017-07-21. High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days. The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.

Latest

CVE-2019-3684, published 2019-05-13. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. SUSE Manager until version 4.0.7 and Uyuni until commit 1b426ad5ed0a7191a6fb46bb83e98ae4b99a5ade created world-readable swap files on systems that don't have a swap already configured and don't have…
CVE-2015-5219, published 2017-07-21. High severity, CVSS 7.5. EPSS: 6.1% chance of exploitation in the next 30 days. The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service…
CVE-2017-7995, published 2017-05-03. Low severity, CVSS 3.8. EPSS: 0.4% chance of exploitation in the next 30 days. Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in…
CVE-2015-7976, published 2017-01-30. Medium severity, CVSS 4.3. EPSS: 3.6% chance of exploitation in the next 30 days. The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a…
CVE-2016-0264, published 2016-05-24. Medium severity, CVSS 5.6. EPSS: 3.9% chance of exploitation in the next 30 days. Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3…