Open Build Service (Opensuse) - vulnerabilities (CVEs)

20 CVEs, 0 in the last 30 days, 157 known versions, newest CVE from 2022-05-03. Vendor: Opensuse.

CVEs of Open Build Service

• CVE-2022-21949 - CVSS 8.8 (high), 2022-05-03: A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in…
• CVE-2021-36777 - CVSS 8.8 (high), 2022-03-09: A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a…
• CVE-2020-8031 - CVSS 6.3 (medium), 2021-02-11: A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS…
• CVE-2018-12475 - CVSS 6.5 (medium), 2020-09-01: A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows…
• CVE-2020-8021 - CVSS 5.3 (medium), 2020-05-19: a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is…
• CVE-2020-8020 - CVSS 6.5 (medium), 2020-05-13: A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause…
• CVE-2019-3685 - CVSS 7.7 (high), 2019-11-05: Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary
• CVE-2018-12474 - CVSS 9.8 (critical), 2018-10-09: Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outside the current…
• CVE-2018-12479 - CVSS 7.5 (high), 2018-10-09: A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affected releases are…
• CVE-2018-12478 - CVSS 6.5 (medium), 2018-10-09: A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs. Affected…
• CVE-2018-12477 - CVSS 7.5 (high), 2018-10-09: A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking…
• CVE-2018-12473 - CVSS 7.5 (high), 2018-10-02: A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build.…
• CVE-2018-12466 - CVSS 6.5 (medium), 2018-08-01: openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.
• CVE-2018-12467 - CVSS 6.5 (medium), 2018-08-01: Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the…
• CVE-2011-4183 - CVSS 9.8 (critical), 2018-06-13: A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.
• CVE-2011-4181 - CVSS 7.5 (high), 2018-06-11: A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE…
• CVE-2013-3703 - CVSS 8.8 (high), 2018-06-08: The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove…
• CVE-2014-0594 - CVSS 8.8 (high), 2018-06-08: In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the…
• CVE-2014-0593 - CVSS 9.8 (critical), 2018-06-08: The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this…
• CVE-2018-7689 - CVSS 7.1 (high), 2018-06-07: Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages…
• CVE-2018-7688 - CVSS 7.1 (high), 2018-06-07: A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects…
• CVE-2011-3178 - CVSS 8.8 (high), 2018-03-20: In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute…
• CVE-2017-9268 - CVSS 6.5 (medium), 2018-03-01: In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to…
• CVE-2017-5188 - CVSS 7.5 (high), 2018-03-01: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during…