File and Path Handling

Every one of the 22 is a mark on the map. Named now: 1 to 22, most at risk first.

1. path traversal in obs-service-tar_scmCVE-2018-12473openSUSE · CVSS 3.1 · 1.8% likely

   CWE-23

2. OBS worker VM escape via relative symbolic linksCVE-2017-5188openSUSE · CVSS 5 · 1.1% likely

   CWE-59

3. Local privilege escalation in exim package from user mail to rootCVE-2020-8015openSUSE · CVSS 8.4 · 0.5% likely

   CWE-59

4. Local privilege escalation from user gnump3d to rootCVE-2019-3697openSUSE · CVSS 7.7 · 0.5% likely

   CWE-59

5. kopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackageCVE-2020-8014openSUSE · CVSS 7.7 · 0.5% likely

   CWE-61

6. python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to rootCVE-2021-25322openSUSE · CVSS 6.8 · 0.4% likely

   CWE-61

7. Local privilege escalation from munin to root in the packaging of muninCVE-2019-3694openSUSE · CVSS 7.7 · 0.4% likely

   CWE-59

8. Local privilege escalation from user privoxy to rootCVE-2019-3699openSUSE · CVSS 7.7 · 0.4% likely

   CWE-59

9. hugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local users to overwrite arbitrary files via a symlink attack on the hugin_debug_optim_re…CVE-2007-5200Opensuse · 0.4% likely

   CWE-59

10. Local privilege escalation to root due to insecure tmp file usageCVE-2020-8032openSUSE · CVSS 6.7 · 0.4% likely

    CWE-377

11. openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itselfCVE-2022-31253openSUSE · CVSS 7.1 · 0.3% likely

    CWE-426

12. python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to rootCVE-2021-31997openSUSE · CVSS 6.8 · 0.3% likely

    CWE-59

13. iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and SUSE Linux Enterprise (SLE) 10 SP2 and 11, and other operating systems, allows local users to overwrite arbitr…CVE-2009-1297Opensuse · 0.3% likely

    CWE-59

14. keylime %post scriplet allows for privilege escalation from keylime user to rootCVE-2022-31250openSUSE · CVSS 7.1 · 0.3% likely

    CWE-59

15. opensuse-updater in openSUSE 10.2 allows local users to access arbitrary files via a symlink attack.CVE-2008-2389Opensuse · 0.3% likely

    CWE-59

16. /etc/init.d/boot.localfs in the aaa_base package before 11.2-43.48.1 in SUSE openSUSE 11.2, and before 11.3-8.7.1 in openSUSE 11.3, allows local users to overwrite arbitrary files…CVE-2011-0461Opensuse · 0.3% likely

    CWE-59

17. watchman: chown in watchman@.socket unit allows symlink attackCVE-2022-21944openSUSE · CVSS 7.8 · 0.3% likely

    CWE-59

18. cscreen: usage of fixed path /tmp/cscreen.debugCVE-2022-21945openSUSE · CVSS 5.1 · 0.2% likely

    CWE-377

19. SUSE-specific logrotate configuration allows escalation from mail user/group to rootCVE-2025-53881openSUSE · CVSS 6.9 · 0.2% likely

    CWE-61

20. A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed:…CVE-2025-46810openSUSE · CVSS 8.5 · 0.2% likely

    CWE-61

21. An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access to possible private inf…CVE-2026-25701openSUSE · CVSS 7 · 0.1% likely

    CWE-377

22. Fixed temporary file path in aeon-checks allows fixing of disk encryption keyCVE-2024-49506openSUSE · CVSS 7.3 · 0.1% likely

    CWE-377

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.