Advisories · Technology
openSUSE Open Build Service.
Every CVE that names openSUSE Open Build Service among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.3 Medium
obs: Stored XSS
- openSUSE Open Build Service
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
obs-service-download_files allows downloading from localhost or intranet hosts
- openSUSE Open Build Service
- CWE-610
- CVSS 5.3 Medium
unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service
- openSUSE Open Build Service
- Privilege escalation
- CVSS 6.5 Medium
Persistent XSS in markdown parser used by obs-server
- openSUSE open-build-service
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Request controller allows to create requests with arbitrary request IDs
- openSUSE Open Build Service
- CWE-20
- CVSS 4.8 Medium
obs-service-replace_using_package_version allows to specify arbitrary input files
- openSUSE Open Build Service
- CWE-20
- CVSS 3.5 Low
obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories
- openSUSE Open Build Service
- Other injection
- CVSS 5.4 Medium
Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm
- openSUSE Open Build Service
- CWE-20
- CVSS 3.1 Low
path traversal in obs-service-tar_scm
- openSUSE Open Build Service
- Path traversal
- CVSS 8.8 High
CSRF protection incorrectly disabled
- openSUSE Open Build Service
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
No write permission check in change_role command
- openSUSE Open Build Service
- Broken access control
- CVSS 7.1 High
Open Build Service arbitrary package modification
- openSUSE Open Build Service
- Broken access control
- CVSS 7.1 High
Open Build Service accepts arbitrary reviews
- openSUSE Open Build Service
- Broken access control
- CVSS 5.0 Medium
OBS worker VM escape via relative symbolic links
- openSUSE open build service