OB
Product
Open Build Service
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 9Medium 11Low 0
Watch
Add Open Build Service to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-4183 | 9.8 | Jun 13 | A vulnerability in open build service allows remote attackers to upload arbitrary RPM files Affected: before 2.1.16 |
| CVE-2014-0593 | 9.8 | Jun 8 | The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS) Affected: 0.5.3 before 1.1 |
| CVE-2022-21949 | 8.8 | May 3 | A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations Affected: before 2.10.13 |
| CVE-2021-36777 | 8.8 | Mar 9 | A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form… Affected: before 2021-10-08 |
| CVE-2014-0594 | 8.8 | Jun 8 | In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent Affected: before 2.4.6 |
| CVE-2011-3178 | 8.8 | Mar 20 | In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode Affected: before 2.3.0 |
| CVE-2019-3685 | 7.7 | Nov 5 | Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary Affected: before 0.165.4 |
| CVE-2018-12479 | 7.5 | Oct 9 | A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs Affected: through 2.9.4 |
| CVE-2018-12473 | 7.5 | Oct 2 | A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build Affected: through 0.9.1 |
| CVE-2011-4181 | 7.5 | Jun 11 | A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled Affected: 2.1.0 before 2.1.16 |
| CVE-2017-5188 | 7.5 | Mar 1 | The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing… Affected: through 2.7.3 |
| CVE-2018-12478 | 6.5 | Oct 9 | A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs Affected: All versions, or not specified |
| CVE-2018-12466 | 6.5 | Aug 1 | openbuildservice allowed deleting packages via project links Affected: before 9.2.4 |
| CVE-2018-12467 | 6.5 | Aug 1 | delete package via link exploit in open buildservice Affected: before 2.9.4 |
| CVE-2013-3703 | 6.5 | Jun 8 | The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from… Affected: 2.4.0 before 2.4.4 |
| CVE-2018-7689 | 6.5 | Jun 7 | Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have… Affected: before 2.9.3 |
| CVE-2018-7688 | 6.5 | Jun 7 | A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have… Affected: before 2.9.3 |
| CVE-2017-9268 | 6.5 | Mar 1 | In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on… Affected: through 2.8.2 |
| CVE-2020-8020 | 6.1 | May 13 | A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS Affected: before 2020-05-13 |
| CVE-2020-8031 | 5.4 | Feb 11 | A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS code in markdown… Affected: before 2.10.8 |
| CVE-2018-12475 | 5.4 | Sep 1 | A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate… Affected: All versions, or not specified |
| CVE-2020-8021 | 5.3 | May 19 | a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue… Affected: before 2.10.5 |
Showing 22