SUSE Linux Enterprise Server 11.0 Service Pack 3 for VMware 15

salt-api unauthenticated remote code execution

libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls

Local privilege escalation from user munge to root

trousers: Local privilege escalation from tss to root

watchman: chown in watchman@.socket unit allows symlink attack

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

obs-service-extract_file's outfilename parameter allows to write files outside of package directory

squid: /usr/sbin/pinger packaged with wrong permission

GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.

GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.

yast2-rmt exposes CA private key passhrase in log-file

libzypp stores cookies world readable