CVE-2018-20468

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution...

Code injection

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution...

Directory traversal

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal arbitrary file access vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files...

Cross site scripting

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. The logs web interface is vulnerable to stored XSS...

CVE-2018-20468

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution...

CVE-2018-20468

CVE-2018-20468 affects Tyto Sahi Pro (versions up to 7.x.x and 8.0.0) where the web reports module’s export-to-Excel feature is vulnerable to CSV injection. An attacker can embed Excel formulas in an automation script, and after export, this can lead to code execution. The available documentation...

CVE-2018-20469

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions...

CVE-2018-20469

CVE-2018-20469 affects Tyto Sahi Pro (through 7.x.x and 8.0.0). The web reports module contains a parameter vulnerable to h2 SQL injection, enabling arbitrary SQL queries and execution of h2 system functions. Exploitation activity is evidenced by public exploit references (exploit DB, PacketStorm...

CVE-2018-20470

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal arbitrary file access vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files...

CVE-2018-20470

Tyto Sahi Pro through 8.0.0 is affected by a Local File Inclusion / directory traversal vulnerability in the web reports module, enabling an attacker to view sensitive server files. Affected: Tyto Sahi Pro versions through 7.x.x and 8.0.0 (per CVE-2018-20470). Root cause: improper handling of fil...

CVE-2018-20472

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. The logs web interface is vulnerable to stored XSS...

CVE-2018-20472

CVE-2018-20472 affects Tyto Sahi Pro up to 8.0.0, where the logs web interface is vulnerable to stored XSS via the Description parameter of Testcase API. The issue is demonstrated by public PoCs/exploits (e.g., Sahi Pro 8.x Cross‑Site Scripting references and exploit disclosures). Public records ...

PT-2019-10076 · Tyto · Tyto Sahi Pro

Name of the Vulnerable Software and Affected Versions: Tyto Sahi Pro versions prior to 8.0.1 Description: An issue was discovered in the logs web interface, which is vulnerable to stored XSS. Recommendations: For versions prior to 8.0.1, update to a version that contains a fix for this issue...

PT-2019-10073 · Tyto · Tyto Sahi Pro

Name of the Vulnerable Software and Affected Versions: Tyto Sahi Pro versions prior to 8.0.1 Description: An issue was discovered in the web reports module of the software, where a parameter is vulnerable to h2 SQL injection. This allows attackers to inject SQL queries and run standard h2 system...

[Sahi] Web Test Automation Tool

Sahi Pro is a powerful tool for automation of web application testing. Sahi Pro helps test web applications across different browsers with high reliability and low maintenance. Existing testing teams with minimal programming knowledge can easily get started and contribute to test automation. Sahi...