77 matches found
PT-2023-18752 · Smartbear · Smartbear Zephyr Enterprise
Name of the Vulnerable Software and Affected Versions: SmartBear Zephyr Enterprise versions prior to 7.15.1 Description: The issue is related to the mishandling of user-defined input during report generation, which could lead to remote code execution by unauthenticated users. Recommendations: For...
CVE-2023-22891
CVE-2023-22891 maps to a privilege-escalation in SmartBear Zephyr Enterprise up to version 7.15.0. Multiple sources indicate that authorized users could reset passwords for other accounts, enabling elevation of privileges with high impact (I/H, A/H, network vector). Publicly disclosed details are...
CVE-2021-41657
SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack...
CVE-2021-41657
SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack...
SmartBear CodeCollaborator 输入验证错误漏洞
SmartBear CodeCollaborator is a code review and documentation review tool from SmartBear. It helps development, testing and management teams to work together to produce high-quality code. A security vulnerability exists in SmartBear CodeCollaborator version v6.1.6102, which stems from a problem...
CVE-2021-41657
SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack...
CVE-2021-41657
SmartBear CodeCollaborator v6.1.6102 contains a web UI vulnerability that enables clickjacking. The affected component is the CodeCollaborator web UI; the underlying issue is an insecure handling of embedded frames that allows an attacker to render a hidden frame and trick an authenticated user i...
PT-2022-11454
Name of the Vulnerable Software and Affected Versions SmartBear CodeCollaborator version 6.1.6102 Description The issue allows an attacker to conduct a clickjacking attack through the web UI. Recommendations For version 6.1.6102, update to a newer version that contains a fix for this issue...
CVE-2020-26118
In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit GWT API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious...
CVE-2020-26118
In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit GWT API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious...
Deserialization of untrusted data
In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit GWT API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious...
CVE-2020-26118
CVE-2020-26118 – SmartBear Collaborator Server : All provided sources describe a post-authentication Java deserialization vulnerability in the server’s UpdateMemento handling of user-supplied serialized objects via the Google Web Toolkit (GWT) API, up to version 13.3.13302. The issue allows an au...
CVE-2020-26118
In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit GWT API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious...
CVE-2020-12835
An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network...
Remote code execution
An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network...
CVE-2020-12835
Affected software: SmartBear ReadyAPI SoapUI Pro 3.2.5 (and related jProductivity Protection! licensing components). Issue: unsafe deserialization via a Java RMI-based protocol in an unsafe configuration that allows an attacker to inject malicious serialized objects, leading to remote code execut...
CVE-2020-12835
An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network...
CVE-2019-12180
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code Java scripting language on the victim machine by inducing it ...
Design/Logic Flaw
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code Java scripting language on the victim machine by inducing it ...
CVE-2019-12180
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code Java scripting language on the victim machine by inducing it ...