CVE-2019-16544

CVE-2019-16544 affects Jenkins QMetry for JIRA - Test Management Plugin (versions ≤ 1.12). The root cause is that credentials were stored in clear text in job config.xml files on the Jenkins master/controller, making them viewable by users with Extended Read permission or by someone with access t...

CVE-2019-16544

Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

PT-2019-14700 · Jenkins · Jenkins Qmetry For Jira - Test Management Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins QMetry for JIRA - Test Management Plugin versions prior to 1.13 Description: The issue concerns the transmission of credentials in plain text as part of job configuration forms, potentially leading to their exposure. Although the...

CloudBees Jenkins Zephyr Enterprise Test Management plugin cross-site request forgery vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. CloudBees. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Zephyr Enterprise Test Management Plugin is used in one of...

CVE-2019-1003085

A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

Input validation

A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

CVE-2019-1003084

CVE-2019-1003084 concerns a cross-site request forgery in the Jenkins Zephyr Enterprise Test Management Plugin, specifically in the ZeeDescriptor#doTestConnection form validation. The issue permits an attacker to initiate a connection to an attacker-specified server, representing a CSRF vulnerabi...

CVE-2019-1003085

Summary: CVE-2019-1003085 affects Jenkins Zephyr Enterprise Test Management Plugin. The root cause is a missing permission check in ZeeDescriptor#doTestConnection form validation, allowing attackers with Overall/Read privileges to initiate a connection to an attacker-specified server. Impact is m...

CVE-2019-1003085

A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

TestLink Open Source Test Management Code Execution

Title: TestLink Open Source Test Management comment out skip-networking as well as bind-address if any present in my.cnf i.e chang...

TestLink Open Source Test Management 1.9.16 - Remote Code Execution

TestLink Open Source Test Management 1.9.16 - Remote Code Execution Title: TestLink Open Source Test Management comment out skip-networking as well as bind-address if any present in m...

TestLink Open Source Test Management < 1.9.16 - Remote Code Execution Vulnerability

Exploit for php platform in category remote exploits Title: TestLink Open Source Test Management comment out skip-networking as well as bind-addre...

TestLink Open Source Test Management Insecure Direct Object Reference

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Insecure Direct Object Reference product: TestLink Open Source Test Management vulnerable version: 1.9.17 fixed version: 1.9.17 after November 2017, and the current...

TestLink Open Source Test Management Insecure Direct Object Reference Vulnerability

Exploit for php platform in category web applications ======================================================================= title: Insecure Direct Object Reference product: TestLink Open Source Test Management vulnerable version: 1.9.17 fixed version: 1.9.17 after November 2017, and the current...

TestLink Cross-Site Scripting Vulnerability

Testlink is TestLink team developed a PHP-based open source test management tool . The tool provides test requirements management , test case management and test data statistics and other functions . TestLink version before 1.9.14 cross-site scripting vulnerability exists. Remote attackers can us...

[SECURITY] Fedora 24 Update: python-wikitcms-2.1.10-1.fc24

python-wikitcms is a library for interacting with Fedora's wiki-based 'test management' system. It can: Create the pages for release validation test events Find existing release validation event pages, in various ways Report test results The wiki-based test management system itself is documented...

[SECURITY] Fedora 25 Update: python-wikitcms-2.1.10-1.fc25

python-wikitcms is a library for interacting with Fedora's wiki-based 'test management' system. It can: Create the pages for release validation test events Find existing release validation event pages, in various ways Report test results The wiki-based test management system itself is documented...

TestLink 1.9.14 SQL Injection

Advisory ID: HTB23288 Product: TestLink Vendor: TestLink Development Team Vulnerable Versions: 1.9.14 and probably prior Tested Version: 1.9.14 Advisory Publication: January 7, 2016 without technical details Vendor Notification: January 7, 2016 Vendor Patch: January 9, 2016 Public Disclosure:...

SQL Injection in TestLink

High-Tech Bridge Security Research Lab discovered high-risk SQL injection vulnerability in TestLink Open Source Test Management. The vulnerability can be exploited to alter the present SQL query and gain access to potentially sensitive information or even to completely compromise the vulnerable w...