Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Manager Client Tools 12 package golang-github-prometheus-promu, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (13)
CVE-2023-3128 — CVSS 9.4 (critical): Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily…
CVE-2024-45337 — CVSS 9.1 (critical): Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be…
CVE-2022-27664 — CVSS 7.5 (high): In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang…
CVE-2022-41715 — CVSS 7.5 (high): Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed…
CVE-2022-27191 — CVSS 7.5 (high): The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain…
CVE-2024-1313 — CVSS 6.5 (medium): It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing…
CVE-2022-46146 — CVSS 6.2 (medium): Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a…
CVE-2023-3978 — CVSS 6.1 (medium): Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to…
CVE-2024-22037 — CVSS 5.5 (medium): The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be…
CVE-2023-6152 — CVSS 5.4 (medium): A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration…
CVE-2025-1365 — CVSS 5.3 (medium): A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file…
CVE-2024-8118: In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert…
CVE-2024-51744 — CVSS 3.1 (low): golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to…