supportutils-plugin-salt (SUSE:Linux Enterprise Server 15 SP5-LTSS) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 15 SP5-LTSS package supportutils-plugin-salt, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2023-3128 — CVSS 9.4 (critical): Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily…
• CVE-2024-45337 — CVSS 9.1 (critical): Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be…
• CVE-2024-22037 — CVSS 5.5 (medium): The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be…
• CVE-2023-6152 — CVSS 5.4 (medium): A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration…
• CVE-2024-8118: In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert…
• CVE-2024-51744 — CVSS 3.1 (low): golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to…