OB
Product
Open Build Service
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 9Medium 11Low 0
Watch
Add Open Build Service to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-12478 | 6.5 | Oct 9 | A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs Affected: All versions, or not specified |
| CVE-2018-12466 | 6.5 | Aug 1 | openbuildservice allowed deleting packages via project links Affected: before 9.2.4 |
| CVE-2018-12467 | 6.5 | Aug 1 | delete package via link exploit in open buildservice Affected: before 2.9.4 |
| CVE-2013-3703 | 6.5 | Jun 8 | The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from… Affected: 2.4.0 before 2.4.4 |
| CVE-2018-7689 | 6.5 | Jun 7 | Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have… Affected: before 2.9.3 |
| CVE-2018-7688 | 6.5 | Jun 7 | A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have… Affected: before 2.9.3 |
| CVE-2017-9268 | 6.5 | Mar 1 | In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on… Affected: through 2.8.2 |
| CVE-2020-8020 | 6.1 | May 13 | A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS Affected: before 2020-05-13 |
| CVE-2020-8031 | 5.4 | Feb 11 | A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS code in markdown… Affected: before 2.10.8 |
| CVE-2018-12475 | 5.4 | Sep 1 | A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate… Affected: All versions, or not specified |
| CVE-2020-8021 | 5.3 | May 19 | a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue… Affected: before 2.10.5 |
Showing 11