Opensuse Open Build Service vulnerabilities

• opensuse open build service Multiple XXE vulnerabilities in OBS CVE-2022-21949 Fix available 8.8 HighMay 3, 2022
• opensuse build service, open build service +1 more login-proxy sends password to attacker-provided domain CVE-2021-36777 8.1 HighMarch 9, 2022
• opensuse open build service obs: Stored XSS CVE-2020-8031 Fix available 6.3 MediumFebruary 11, 2021
• opensuse open build service obs-service-download_files allows downloading from localhost or intranet hosts CVE-2018-12475 6.5 MediumSeptember 1, 2020
• opensuse open build service, debian linux +1 more unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service CVE-2020-8021 Fix available 5.3 MediumMay 19, 2020
• opensuse open-build-service, debian linux, opensuse open build service +2 more Persistent XSS in markdown parser used by obs-server CVE-2020-8020 Fix available 6.5 MediumMay 13, 2020
• open build service build service, opensuse open build service +1 more Missing TLS certificate validation for HTTPS connections in osc CVE-2019-3685 Fix available 7.4 HighAugust 6, 2019
• opensuse open build service Request controller allows to create requests with arbitrary request IDs CVE-2018-12479 Fix available 6.5 MediumOctober 9, 2018
• opensuse open build service obs-service-replace_using_package_version allows to specify arbitrary input files CVE-2018-12478 4.8 MediumOctober 9, 2018
• opensuse open build service path traversal in obs-service-tar_scm CVE-2018-12473 3.1 LowOctober 2, 2018
• opensuse openbuildservice, open build service +1 more delete package via link exploit in open buildservice CVE-2018-12467 Fix available 6.0 MediumAugust 1, 2018
• opensuse openbuildservice, open build service +1 more openbuildservice allowed deleting packages via project links CVE-2018-12466 Fix available 4.4 MediumAugust 1, 2018
• opensuse open build service open build service allows anyone to upload rpms CVE-2011-4183 6.5 MediumJune 13, 2018
• opensuse open build service open build service information leak via unauthorized source access CVE-2011-4181 4.3 MediumJune 11, 2018
• opensuse open build service CSRF protection incorrectly disabled CVE-2014-0594 8.8 HighJune 8, 2018
• opensuse open build service, obs-service-set version +1 more sed command injection CVE-2014-0593 Fix available 7.8 HighJune 8, 2018
• opensuse open build service No write permission check in change_role command CVE-2013-3703 8.8 HighJune 8, 2018
• opensuse open build service Open Build Service arbitrary package modification CVE-2018-7689 Fix available 7.1 HighJune 7, 2018
• opensuse open build service Open Build Service accepts arbitrary reviews CVE-2018-7688 Fix available 7.1 HighJune 7, 2018
• opensuse openbuildservice, open build service +1 more openbuildservice webui code injection CVE-2011-3178 8.1 HighMarch 20, 2018
• opensuse open build service open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions CVE-2017-9268 Fix available 4.4 MediumMarch 1, 2018
• opensuse open build service OBS worker VM escape via relative symbolic links CVE-2017-5188 Fix available 5.0 MediumMarch 1, 2018