openSUSE Open Build Service vulnerabilities

13 published CVEs name openSUSE Open Build Service among the affected products.

Newest CVEs

CVE-2020-8031
obs: Stored XSS
openSUSE · Open Build Service
Medium6.3
CVE-2018-12475
obs-service-download_files allows downloading from localhost or intranet hosts
openSUSE · Open Build Service
Medium6.5
CVE-2020-8021
unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service
openSUSE · Open Build Service
Medium5.3
CVE-2018-12479
Request controller allows to create requests with arbitrary request IDs
openSUSE · Open Build Service
Medium6.5
CVE-2018-12478
obs-service-replace_using_package_version allows to specify arbitrary input files
openSUSE · Open Build Service
Medium4.8
CVE-2018-12477
obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories
openSUSE · Open Build Service
Low3.5
CVE-2018-12474
Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm
openSUSE · Open Build Service
Medium5.4
CVE-2018-12473
path traversal in obs-service-tar_scm
openSUSE · Open Build Service
Low3.1
CVE-2014-0594
CSRF protection incorrectly disabled
openSUSE · Open Build Service
High8.8
CVE-2013-3703
No write permission check in change_role command
openSUSE · Open Build Service
High8.8