CVE-2011-2652

CVE-2011-2652 affects Kiwi prior to 3.74.2, including deployments in SUSE Studio 1.1 before 1.1.4. The vulnerability arises from a cross-site scripting flaw in the overlay file workflow triggered by a crafted archive file list, enabling remote attackers to inject arbitrary scripts/HTML. Impact is...

CVE-2011-2225

CVE-2011-2225 affects Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4. The vulnerability allows an attacker to achieve an unknown impact through a crafted directory pathname inserted into config.sh. The available documents do not specify the exact root cause, affected files beyond Kiw...

CVE-2011-2226

The CVE-2011-2226 entry describes a Cross-site scripting (XSS) vulnerability in Kiwi before version 3.74.2, applicable to SUSE Studio 1.1 before 1.1.4. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, in a scenario related to a pattern list...

CVE-2011-2647

Kiwi before 3.74.2 contains a remote code execution vulnerability exploitable via a crafted archive name in the list of testdrive modified files, as used in SUSE Studio 1.1 before 1.1.4. The issue is documented in multiple sources (SUSE/SUSE CVE, NVD) with the affected component being Kiwi, and t...

CVE-2011-2645

Kiwi before 3.74.2, used in SUSE Studio 1.1 before 1.1.4, contains an unspecified vulnerability that allows remote attackers to execute arbitrary code via a crafted filename for a custom RPM. The issue is documented across multiple sources (SUSE CVE entry and NVD) with no publicly detailed root-c...

CVE-2011-2646

Kiwi prior to 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, is affected by CVE-2011-2646. The flaw allows remote attackers to execute arbitrary code by supplying a crafted filename within the list of testdrive modified files. The SUSE advisory confirms the vulnerable component (Kiwi) and affec...

CVE-2011-2648

CVE-2011-2648 affects Kiwi prior to 3.74.2 as used in SUSE Studio 1.1 prior to 1.1.4. The vulnerability permits remote code execution via a filter in a modified file. This CVE has a documented CVSSv2 base score of 7.5 (HIGH) with network access, low attack complexity, no authentication, and parti...

CVE-2011-2649

Kiwi before 3.74.2 (as used in SUSE Studio 1.1 before 1.1.4) is vulnerable to command execution via shell metacharacters in an unspecified FileUtils function. The root cause is not fully detailed in the provided documents, but the vulnerability allows an attacker to execute arbitrary commands. Th...

CVE-2011-2650

The connected SUSE advisory confirms an XSS vulnerability in Kiwi prior to 3.74.2, as used in SUSE Studio 1.1 prior to 1.1.4, allowing remote attackers to inject arbitrary web script or HTML via a crafted pattern name shown in an RPM info display. No exploit details are provided in the documents,...

CVE-2011-2651

The CVE-2011-2651 entry concerns the Kiwi file browser prior to 3.74.2 (used in SUSE Studio 1.1 prior to 1.1.4). A vulnerability in the file browser allows remote attackers to execute arbitrary code via a crafted filename. The connected sources confirm the affected software and the nature of impa...

CVE-2011-2644

The CVE-2011-2644 entry affects Kiwi prior to version 3.74.2 (used in SUSE Studio 1.1 prior to 1.1.4). The vulnerability is described as a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to an RPM info display. I...