CVE-2014-0594

In the Open Build Service OBS before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent...

CVE-2013-3703

The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...

Cross site request forgery (csrf)

In the Open Build Service OBS before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent...

Code injection

The setversion script as shipped with obs-service-setversion is a source validator for the Open Build Service OBS. In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server...

Design/Logic Flaw

The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...

CVE-2014-0594 CSRF protection incorrectly disabled

In the Open Build Service OBS before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent...

CVE-2013-3703 No write permission check in change_role command

The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...

CVE-2014-0594

The CVE-2014-0594 entry corresponds to the Open Build Service (OBS) before version 2.4.6, where CSRF protection was incorrectly disabled in the web interface. This allows an attacker to issue requests without user consent, with impact across confidentiality, integrity, and availability as reflect...

CVE-2014-0593 sed command injection

The setversion script as shipped with obs-service-setversion is a source validator for the Open Build Service OBS. In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server...

CVE-2014-0594

In the Open Build Service OBS before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent...

CVE-2014-0593

The CVE concerns obs-service-set_version, a script used as a source validator in the Open Build Service (OBS). In versions prior to 0.5.3-1.1 the set_version script did not properly sanitize user input, allowing code execution on the executing server. Public references in the connected documents ...

CVE-2013-3703

CVE-2013-3703 concerns the Open Build Service API controller prior to version 2.4.4. The root cause is a missing write-permission check, which allows an authenticated attacker to add or remove user roles from packages and/or project metadata. The vulnerability applies to the Open Build Service AP...

UBUNTU-CVE-2018-7689

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions...

CVE-2018-7689

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions...

CVE-2018-7688

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions...

CVE-2018-7688

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions...

DEBIAN-CVE-2018-7688

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions...

UBUNTU-CVE-2018-7688

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions...

CVE-2018-7689

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions...

DEBIAN-CVE-2018-7689

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions...