Skip to contentOpensuse Open Build Service vulnerabilities
- opensuse open build serviceobs: Stored XSSCVE-2020-8031Fix available6.3 Medium
- opensuse open build serviceobs-service-download_files allows downloading from localhost or intranet hostsCVE-2018-124756.5 Medium
- opensuse open build service, debian linux +1 moreunauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build ServiceCVE-2020-8021Fix available5.3 Medium
- opensuse open build serviceRequest controller allows to create requests with arbitrary request IDsCVE-2018-12479Fix available6.5 Medium
- opensuse open build serviceobs-service-replace_using_package_version allows to specify arbitrary input filesCVE-2018-124784.8 Medium
- opensuse open build service, leap +1 moreobs-service-refresh_patches can be tricked into deleting '..' or other unrelated directoriesCVE-2018-12477Fix available3.5 Low
- opensuse open build service, tar scm +1 moreCrafted service parameters allows to induce unexpected behaviour in obs-service-tar_scmCVE-2018-124745.4 Medium
- opensuse open build servicepath traversal in obs-service-tar_scmCVE-2018-124733.1 Low
- opensuse open build serviceCSRF protection incorrectly disabledCVE-2014-05948.8 High
- opensuse open build serviceNo write permission check in change_role commandCVE-2013-37038.8 High
- opensuse open build serviceOpen Build Service arbitrary package modificationCVE-2018-7689Fix available7.1 High
- opensuse open build serviceOpen Build Service accepts arbitrary reviewsCVE-2018-7688Fix available7.1 High
- opensuse open build serviceOBS worker VM escape via relative symbolic linksCVE-2017-5188Fix available5.0 Medium