What’s Vulnerable › Products
openSUSE Open Build Service vulnerabilities
22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 0 published in the last 12 months.
Check whether your openSUSE Open Build Service version is affected
Latest openSUSE Open Build Service vulnerabilities
- CVE-2022-21949 — Multiple XXE vulnerabilities in OBS (CVSS 8.8)
- CVE-2021-36777 — login-proxy sends password to attacker-provided domain (CVSS 8.8)
- CVE-2020-8031 — obs: Stored XSS (CVSS 5.4)
- CVE-2018-12475 — obs-service-download_files allows downloading from localhost or intranet hosts (CVSS 5.4)
- CVE-2020-8021 — unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service (CVSS 5.3)
- CVE-2020-8020 — Persistent XSS in markdown parser used by obs-server (CVSS 6.1)
- CVE-2019-3685 — Missing TLS certificate validation for HTTPS connections in osc (CVSS 7.7)
- CVE-2018-12479 — Request controller allows to create requests with arbitrary request IDs (CVSS 7.5)
- CVE-2018-12478 — obs-service-replace_using_package_version allows to specify arbitrary input files (CVSS 6.5)
- CVE-2018-12473 — path traversal in obs-service-tar_scm (CVSS 7.5)
- CVE-2018-12467 — delete package via link exploit in open buildservice (CVSS 6.5)
- CVE-2018-12466 — openbuildservice allowed deleting packages via project links (CVSS 6.5)
- CVE-2011-4183 — open build service allows anyone to upload rpms (CVSS 9.8)
- CVE-2011-4181 — open build service information leak via unauthorized source access (CVSS 7.5)
- CVE-2014-0594 — CSRF protection incorrectly disabled (CVSS 8.8)
- CVE-2014-0593 — sed command injection (CVSS 9.8)
- CVE-2013-3703 — No write permission check in change_role command (CVSS 6.5)
- CVE-2018-7689 — Open Build Service arbitrary package modification (CVSS 6.5)
- CVE-2018-7688 — Open Build Service accepts arbitrary reviews (CVSS 6.5)
- CVE-2011-3178 — openbuildservice webui code injection (CVSS 8.8)
- CVE-2017-9268 — open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions (CVSS 6.5)
- CVE-2017-5188 — OBS worker VM escape via relative symbolic links (CVSS 7.5)