Suse Package Hub vulnerabilities

39 CVEs affecting Suse Package Hub, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-24368, published 2020-08-19.

More from Suse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-1646: Google Chromium V8 Out-of-Bounds Read Vulnerability, published 2016-03-29. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 48.1% chance of exploitation in the next 30 days. The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to…
• CVE-2019-11730, published 2019-07-23. Medium severity, CVSS 6.5. EPSS: 20.3% chance of exploitation in the next 30 days. A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed.…
• CVE-2019-19926, published 2019-12-23. High severity, CVSS 7.5. EPSS: 8% chance of exploitation in the next 30 days. multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an…
• CVE-2019-19880, published 2019-12-18. High severity, CVSS 7.5. EPSS: 6.9% chance of exploitation in the next 30 days. exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
• CVE-2019-19925, published 2019-12-24. High severity, CVSS 7.5. EPSS: 6.8% chance of exploitation in the next 30 days. zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
• CVE-2019-19923, published 2019-12-24. High severity, CVSS 7.5. EPSS: 6.8% chance of exploitation in the next 30 days. flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or…
• CVE-2019-13764, published 2019-12-10. High severity, CVSS 8.8. EPSS: 6.4% chance of exploitation in the next 30 days. Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2019-13734, published 2019-12-10. High severity, CVSS 8.8. EPSS: 3.9% chance of exploitation in the next 30 days. Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2020-24368, published 2020-08-19. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web…
• CVE-2019-5798, published 2019-05-23. Medium severity, CVSS 6.5. EPSS: 3.2% chance of exploitation in the next 30 days. Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Latest

• CVE-2020-10803, published 2020-03-22. Medium severity, CVSS 5.4. EPSS: 1.4% chance of exploitation in the next 30 days. In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results…
• CVE-2020-10802, published 2020-03-22. High severity, CVSS 8.0. EPSS: 1.8% chance of exploitation in the next 30 days. In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search…
• CVE-2020-10804, published 2020-03-22. High severity, CVSS 8.0. EPSS: 2.4% chance of exploitation in the next 30 days. In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and…
• CVE-2020-6416, published 2020-02-11. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2020-6415, published 2020-02-11. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2020-6408, published 2020-02-11. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a crafted HTML page.
• CVE-2020-6406, published 2020-02-11. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2020-6404, published 2020-02-11. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2020-6403, published 2020-02-11. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.