saltboot-formula (SUSE:Manager Server Module 4.2) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Manager Server Module 4.2 package saltboot-formula, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (13)

• CVE-2018-20433 — CVSS 9.8 (critical): c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
• CVE-2021-40323 — CVSS 9.8 (critical): Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template…
• CVE-2021-41411 — CVSS 9.8 (critical): drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used…
• CVE-2021-42740 — CVSS 9.8 (critical): The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a…
• CVE-2022-0860 — CVSS 9.1 (critical): Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
• CVE-2022-1415 — CVSS 8.1 (high): A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an…
• CVE-2021-43138 — CVSS 7.8 (high): In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js…
• CVE-2021-40324 — CVSS 7.5 (high): Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
• CVE-2022-31129 — CVSS 7.5 (high): moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to…
• CVE-2019-5427 — CVSS 7.5 (high): c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against…
• CVE-2021-40325 — CVSS 7.5 (high): Cobbler before 3.3.0 allows authorization bypass for modification of settings.
• CVE-2020-25638 — CVSS 7.4 (high): A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA…
• CVE-2022-40152 — CVSS 6.5 (medium): Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is…