Factory
Vendor:
First CVE: Jan 23, 2020 · Active for 6 years
23
Total CVEs
More Total CVEs than 95% of tracked products
7.7
Avg CVEs / Year
Higher CVE frequency than 93% of tracked products
6.8
Avg CVSS
Higher Avg CVSS than 36% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Factory over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 23, 2020
6 years ago
Most Recent CVE
Oct 26, 2022
1,367 days ago
CVE Severity & Scoring
Factory23 CVEs
35%
57%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local20 (87.0%)
Network3 (13.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low22 (95.7%)
High1 (4.3%)
Unknown0 (0.0%)
User Interaction
None20 (87.0%)
Unknown0 (0.0%)
Required3 (13.0%)
Privileges Required
Low17 (73.9%)
High0 (0.0%)
None6 (26.1%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-3681CRITICAL A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE L | Jun 29, 2020 | 9.8 | 31 | NO | NO |
CVE-2021-4166HIGH vim is vulnerable to Out-of-bounds Read | Dec 25, 2021 | 7.1 | 27 | NO | NO |
CVE-2021-41819HIGH CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. | Jan 1, 2022 | 7.5 | 26 | NO | NO |
CVE-2021-41817HIGH Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. | Jan 1, 2022 | 7.5 | 26 | NO | NO |
CVE-2022-31256HIGH A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to esca | Oct 26, 2022 | 7.8 | 25 | NO | NO |
CVE-2021-45082HIGH An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODUL | Feb 19, 2022 | 7.8 | 25 | NO | NO |
CVE-2021-31997HIGH A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin | Jun 10, 2021 | 7.8 | 25 | NO | NO |
CVE-2021-25322HIGH A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or | Jun 10, 2021 | 7.8 | 25 | NO | NO |
CVE-2021-25321HIGH A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Fa | Jun 30, 2021 | 7.8 | 24 | NO | NO |
CVE-2021-25319HIGH A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affe | May 5, 2021 | 7.8 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (23 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (23 CVEs).
Media Mentions
Signals from CVEs in this product scope (23 CVEs).
Top CNAs Publishing CVEs For Factory
Top CWEs
Versions
No cataloged versions.