CVSS: 9.8EPSS: 1%CPEs: 10EXPL: 1CVE-2019-3681 – osc: stores downloaded (supposed) RPM in network-controlled filesystem paths
https://notcve.org/view.php?id=CVE-2019-3681
29 Jun 2020 — A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development ... • https://bugzilla.suse.com/show_bug.cgi?id=1122675 • CWE-73: External Control of File Name or Path •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2012-1095
https://notcve.org/view.php?id=CVE-2012-1095
06 Feb 2014 — osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator. osc anterior a 0.134 podría permitir a servidores de repositorios OBS remotos o equipos de mantenimiento de paquetes ejecutar comandos arbitrarios a través del (1) registro o (2) estado de creación manipulados que contienen una secuencia de escape para un emulador de terminal. • http://lists.opensuse.org/opensuse-updates/2012-03/msg00035.html • CWE-264: Permissions, Privileges, and Access Controls •