428 matches found
Sql injection
An issue was discovered in TestLink 1.9.19. The relationtype parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection...
CVE-2020-8841
An issue was discovered in TestLink 1.9.19. The relationtype parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection...
CVE-2020-8841
An issue was discovered in TestLink 1.9.19. The relationtype parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection...
CVE-2020-8841
An issue was discovered in TestLink 1.9.19. The relationtype parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection...
CVE-2020-8841
CVE-2020-8841 affects TestLink 1.9.19. The issue is an authenticated SQL Injection in the relation_type parameter of the lib/requirements/reqSearch.php endpoint. This vulnerability arises from improper handling/validation of external input, enabling an attacker with authenticated access to inject...
PT-2020-20317
Name of the Vulnerable Software and Affected Versions TestLink version 1.9.19 Description An issue was discovered that allows for authenticated SQL Injection through the relation type parameter of the "lib/requirements/reqSearch.php" endpoint. Recommendations For TestLink version 1.9.19, avoid...
CVE-2020-8841: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in TestLink 1.9.19. The relationtype parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection...
CVE-2019-20381
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491...
CVE-2019-20381
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491...
Cross site scripting
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491...
CVE-2019-20381
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491...
CVE-2019-20381
TestLink
CVE-2019-20381
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491...
TestLink cross-site scripting vulnerability (CNVD-2020-03254)
TestLink is a set of open source software for managing the software testing process and providing statistical analysis. A cross-site scripting vulnerability exists in TestLink versions prior to 1.9.20. The vulnerability stems from a lack of proper validation of client-side data by the WEB...
PT-2020-10409
Name of the Vulnerable Software and Affected Versions TestLink versions prior to 1.9.20 Description The issue allows for XSS via non-lowercase javascript: in the reqURI parameter of index.php. This problem exists due to an incomplete fix for a previous issue. Recommendations For versions prior to...
CVE-2019-20381: Improper Neutralization of Input During Web Page Generation
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491...
CVE-2019-19491
TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request...
CVE-2019-19491
TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request...
Cross site request forgery (csrf)
TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request...