WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Privilege Escalation
Suse Lifecycle Management Server
Studio Onsite
Webyast
NVD
GitHub
CVSS 2.0
7.2
EPSS
0.0%
SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary SQL commands via vectors related to the "filtering table. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Red Hat
SQLi
Enterprise Mrg
NVD
CVSS 2.0
7.5
EPSS
0.4%