Matthias Gerstner of SUSE

obs-service-download_files allows downloading from localhost or intranet hosts

python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root

virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group

libzypp stores cookies world readable

obs-service-extract_file's outfilename parameter allows to write files outside of package directory

obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories

Request controller allows to create requests with arbitrary request IDs

race condition in the packaging of texlive-filesysten

outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues

obs-service-replace_using_package_version allows to specify arbitrary input files