Open Build Service@* Security Vulnerabilities and Issues — Open Build Service@* CVE List

Lucene search

OpensuseOpen Build Service*

13 matches found

CVE•added 2019/11/05 10:15 a.m.•128 views

CVE-2019-3685

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

7.7CVSS7.6AI score0.00164EPSS

CVE•added 2022/03/09 5:15 p.m.•83 views

CVE-2021-36777

A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This issue affects: openSUSE Build service l...

8.8CVSS8.3AI score0.00307EPSS

CVE•added 2022/05/03 8:15 a.m.•74 views

CVE-2022-21949

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue a...

9CVSS8.9AI score0.01579EPSS

CVE•added 2018/06/07 1:29 p.m.•61 views

CVE-2018-7689

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.

7.1CVSS6AI score0.00165EPSS

CVE•added 2020/05/19 3:15 p.m.•53 views

CVE-2020-8021

a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5.

5.3CVSS5.3AI score0.00186EPSS

CVE•added 2020/05/13 3:15 p.m.•52 views

CVE-2020-8020

A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb.

6.5CVSS6.3AI score0.0022EPSS

CVE•added 2018/06/07 1:29 p.m.•47 views

CVE-2018-7688

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.

7.1CVSS6.4AI score0.00165EPSS

CVE•added 2021/02/11 3:15 p.m.•44 views

CVE-2020-8031

A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. This issue affects: Open Build Service versions prio...

6.3CVSS5.7AI score0.00217EPSS

CVE•added 2018/03/20 6:29 p.m.•41 views

CVE-2011-3178

In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode.

8.8CVSS8.7AI score0.00333EPSS

CVE•added 2018/08/01 3:29 p.m.•41 views

CVE-2018-12466

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.

6.5CVSS5.3AI score0.00176EPSS

CVE•added 2018/06/13 1:29 p.m.•39 views

CVE-2011-4183

A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.

9.8CVSS8.1AI score0.00373EPSS

CVE•added 2018/08/01 3:29 p.m.•39 views

CVE-2018-12467

Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.

6.5CVSS6.2AI score0.00165EPSS

CVE•added 2018/06/08 5:29 p.m.•34 views

CVE-2014-0594

In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.

8.8CVSS8.8AI score0.00141EPSS