Suse Build vulnerabilities

• opensuse open build service Multiple XXE vulnerabilities in OBS CVE-2022-21949 Fix available 8.8 HighMay 3, 2022
• opensuse open build service obs: Stored XSS CVE-2020-8031 Fix available 6.3 MediumFebruary 11, 2021
• opensuse open build service obs-service-download_files allows downloading from localhost or intranet hosts CVE-2018-12475 6.5 MediumSeptember 1, 2020
• opensuse open build service, debian linux +1 more unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service CVE-2020-8021 Fix available 5.3 MediumMay 19, 2020
• opensuse leap 15.1, pcp, suse linux enterprise high performance computing 15-espos +8 more +10 more pcp: Local privilege escalation from user pcp to root through migrate_tempdirs CVE-2019-3696 8.4 HighFebruary 7, 2020
• opensuse leap 15.1, pcp, suse linux enterprise high performance computing 15-espos +8 more +10 more pcp: Local privilege escalation from user pcp to root CVE-2019-3695 8.4 HighFebruary 7, 2020
• open build service build service, opensuse open build service +1 more Missing TLS certificate validation for HTTPS connections in osc CVE-2019-3685 Fix available 7.4 HighAugust 6, 2019
• opensuse open build service Request controller allows to create requests with arbitrary request IDs CVE-2018-12479 Fix available 6.5 MediumOctober 9, 2018
• opensuse open build service obs-service-replace_using_package_version allows to specify arbitrary input files CVE-2018-12478 4.8 MediumOctober 9, 2018
• opensuse open build service, leap +1 more obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories CVE-2018-12477 Fix available 3.5 LowOctober 9, 2018
• opensuse open build service, tar scm +1 more Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm CVE-2018-12474 5.4 MediumOctober 9, 2018
• opensuse open build service path traversal in obs-service-tar_scm CVE-2018-12473 3.1 LowOctober 2, 2018
• opensuse open build service open build service allows anyone to upload rpms CVE-2011-4183 6.5 MediumJune 13, 2018
• opensuse open build service open build service information leak via unauthorized source access CVE-2011-4181 4.3 MediumJune 11, 2018
• opensuse open build service CSRF protection incorrectly disabled CVE-2014-0594 8.8 HighJune 8, 2018
• opensuse open build service No write permission check in change_role command CVE-2013-3703 8.8 HighJune 8, 2018
• opensuse open build service Open Build Service arbitrary package modification CVE-2018-7689 Fix available 7.1 HighJune 7, 2018
• opensuse open build service Open Build Service accepts arbitrary reviews CVE-2018-7688 Fix available 7.1 HighJune 7, 2018
• opensuse open buildservice, suse open build service +1 more open build service source server symlink exploitation via source patch CVE-2015-0796 6.3 MediumMarch 2, 2018
• opensuse open build service open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions CVE-2017-9268 Fix available 4.4 MediumMarch 1, 2018
• opensuse open build service OBS worker VM escape via relative symbolic links CVE-2017-5188 Fix available 5.0 MediumMarch 1, 2018
• suse build, opensuse leap, suse linux enterprise software development kit +2 more package builds could use directory traversal to write outside of target area CVE-2017-14804 Fix available 9.9 CriticalDecember 8, 2017