CVE-2019-3681

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

• CWE-73

• https://bugzilla.suse.com/show_bug.cgi?id=1122675Exploit, Issue Tracking, Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1122675Exploit, Issue Tracking, Vendor Advisory

Published

Jun 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3662Path Traversal: '/absolute/pathname/here' vulnerability in M…6.5
• CVE-2019-3663Unprotected Storage of Credentials vulnerability in McAfee A…7.8
• CVE-2019-3665Code Injection vulnerability in the web interface in McAfee …6.5
• CVE-2019-3666API Abuse/Misuse vulnerability in the web interface in McAfe…6.5
• CVE-2019-3667DLL Search Order Hijacking vulnerability in the Microsoft Wi…7.8
• CVE-2019-3670Remote Code Execution vulnerability in the web interface in …6.1
• CVE-2019-3682The docker-kubic package in SUSE CaaS Platform 3.0 before 17…7.8
• CVE-2019-3683The keystone-json-assignment package in SUSE Openstack Cloud…8.8
• CVE-2019-3684SUSE Manager until version 4.0.7 and Uyuni until commit 1b42…5.9
• CVE-2019-3685Open Build Service before version 0.165.4 diddn't validate T…7.7
• CVE-2019-3686openQA before commit c172e8883d8f32fced5e02f9b6faaacc913df27…6.1
• CVE-2019-3687The permission package in SUSE Linux Enterprise Server allow…3.3