Matthias Gerstner of SUSE

libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls

DoS attacks, information leaks etc. with crafted Git repositories in obs-scm-bridge

A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen This issue affects opensuse-welcome: from 0.1 before 0.1.9+gi

A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects S

python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root

Deprecated functionality in autoyast2 automatically imports gpg keys without checking them

race condition on texlive-filesystem cron job allows for the deletion of unintended files

apt-cacher-ng insecure use of /run/apt-cacher-ng

suddoers configuration for cscreen not restrictive enough

cscreen: usage of fixed path /tmp/cscreen.debug