openSUSE openbuildservice vulnerabilities

Latest openSUSE openbuildservice CVEs

Newest publication first

1. CVE-2018-12467 delete package via link exploit in open buildservice

   Published 2018-08-01

   Medium·CVSS 6.5 EPSS 0.65%

   Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.

2. CVE-2018-12466 openbuildservice allowed deleting packages via project links

   Published 2018-08-01

   Medium·CVSS 6.5 EPSS 0.80%

   openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.

3. CVE-2011-3178 openbuildservice webui code injection

   Published 2018-03-20

   High·CVSS 8.8 EPSS 1.3%

   In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.