CVE-2019-10444

Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM...

CVE-2024-11084

Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists...

CVE-2024-11084

Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists...

CVE-2024-11084 Potential Username Enumeration in Helix ALM

Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists...

CVE-2024-11084

CVE-2024-11084 affects Perforce Helix ALM prior to 2025.1. The issue is that authentication returns distinct error responses, enabling an attacker to determine whether a username exists (username enumeration). The connected sources (RH Red Hat, NVD, CVE Lists, CNNVD) corroborate the same descript...

CVE-2024-11084 Potential Username Enumeration in Helix ALM

Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists...

PT-2025-16354

Name of the Vulnerable Software and Affected Versions Helix ALM versions prior to 2025.1 Description The issue allows an attacker to determine whether a username exists due to distinct error responses during authentication. Recommendations For versions prior to 2025.1, update to version 2025.1 or...

CVE-2024-11084: Observable Discrepancy

Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists...

CVE-2024-23813

A vulnerability has been identified in Polarion ALM All versions V2404.0. The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code...

CVE-2024-10923

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in OpenText™ ALM Octane Management allows Stored XSS. The vulnerability could result in a remote code execution attack. This issue affects ALM Octane Management: from 16.2.100 through 24.4...

CVE-2024-10923

OpenText ALM Octane Management is affected (versions 16.2.100 through 24.4) by a Stored XSS flaw due to improper neutralization of input during web page generation. The issue could lead to remote code execution. Root cause is improper input handling in the web page generation path; CVSS suggests ...

CVE-2024-10923 Improper Neutralization vulnerability has been discovered in OpenText™ ALM Octane Management.

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in OpenText™ ALM Octane Management allows Stored XSS. The vulnerability could result in a remote code execution attack. This issue affects ALM Octane Management: from 16.2.100 through 24.4...

CVE-2024-10923 Improper Neutralization vulnerability has been discovered in OpenText™ ALM Octane Management.

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in OpenText™ ALM Octane Management allows Stored XSS. The vulnerability could result in a remote code execution attack. This issue affects ALM Octane Management: from 16.2.100 through 24.4...

PT-2024-16644

Name of the Vulnerable Software and Affected Versions OpenText ALM Octane Management versions 16.2.100 through 24.4 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This could result i...

CVE-2024-10923: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in OpenText™ ALM Octane Management allows Stored XSS. The vulnerability could result in a remote code execution attack. This issue affects ALM Octane Management: from 16.2.100 through 24.4...

CVE-2024-4211

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation...

CVE-2024-4211 Multiple missing permission checks

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation...

CVE-2024-4211

CVE-2024-4211 affects OpenText Application Automation Tools (v24.1.0 and below). Root cause: improper validation of input quantity coupled with multiple missing permission checks in ALM job configuration. Impact: users with Overall/Read permission could enumerate ALM server names, usernames and c...

CVE-2024-4211 Multiple missing permission checks

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation...

CVE-2024-4184 Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below...