Opensuse Build Service vulnerabilities

• opensuse build service, open build service +1 more login-proxy sends password to attacker-provided domain CVE-2021-36777 8.1 HighMarch 9, 2022
• opensuse open build service obs: Stored XSS CVE-2020-8031 Fix available 6.3 MediumFebruary 11, 2021
• opensuse open build service obs-service-download_files allows downloading from localhost or intranet hosts CVE-2018-12475 6.5 MediumSeptember 1, 2020
• opensuse open build service, debian linux +1 more unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service CVE-2020-8021 Fix available 5.3 MediumMay 19, 2020
• opensuse open build service Request controller allows to create requests with arbitrary request IDs CVE-2018-12479 Fix available 6.5 MediumOctober 9, 2018
• opensuse open build service obs-service-replace_using_package_version allows to specify arbitrary input files CVE-2018-12478 4.8 MediumOctober 9, 2018
• opensuse open build service, leap +1 more obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories CVE-2018-12477 Fix available 3.5 LowOctober 9, 2018
• opensuse open build service, tar scm +1 more Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm CVE-2018-12474 5.4 MediumOctober 9, 2018
• opensuse open build service path traversal in obs-service-tar_scm CVE-2018-12473 3.1 LowOctober 2, 2018
• opensuse open build service CSRF protection incorrectly disabled CVE-2014-0594 8.8 HighJune 8, 2018
• opensuse open build service No write permission check in change_role command CVE-2013-3703 8.8 HighJune 8, 2018
• opensuse open build service Open Build Service arbitrary package modification CVE-2018-7689 Fix available 7.1 HighJune 7, 2018
• opensuse open build service Open Build Service accepts arbitrary reviews CVE-2018-7688 Fix available 7.1 HighJune 7, 2018
• opensuse open build service OBS worker VM escape via relative symbolic links CVE-2017-5188 Fix available 5.0 MediumMarch 1, 2018