Matthias Gerstner of SUSE

path traversal via `config` parameter in qSnapper

Weak polkit authentication check in qSnapper

malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API

The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can chown() arbitrary files in the system.

Incomplete privilege drop for com.system76.CosmicGreeter.GetUserData

The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess

A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affects lightdm-kde-greeter. before 6.0.4.

An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access to possible private information found in /var/lib/pcrlock.d * manipulate the data backed up i

Polkit Authorization Check can be Bypassed in the TLP power daemon

Lack of Authentication in the InputManager D-Bus interface