PT-2023-12285 · Gurock · Gurock Testrail

Name of the Vulnerable Software and Affected Versions: Gurock TestRail versions prior to 7.1.2 Description: The issue allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports. This is a Cross Site Scripting XSS issue...

CVE-2021-36538

CVE-2021-36538 affects Gurock TestRail before 7.1.2. The vulnerability is a cross-site scripting (XSS) flaw that enables remote authenticated attackers to execute arbitrary code via the reference field in milestones or the description fields in reports. The root cause details are not fully descri...

Gurock Software Gurock TestRail 跨站脚本漏洞

Gurock Software Gurock TestRail is a web-based test case management software for QA and development teams from Gurock Software. The software supports the creation of test cases, the management of test suites and the coordination of the testing process. A security vulnerability exists in Gurock...

CVE-2021-36538: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports...

Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

GHSA-PWRM-8MVM-P2F2 Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

CVE-2021-44263

Gurock TestRail before 7.2.4 mishandles HTML escaping...

CVE-2021-44263

Gurock TestRail before 7.2.4 mishandles HTML escaping...

CVE-2021-44263

Gurock TestRail before 7.2.4 mishandles HTML escaping...

Hardcoded credentials

Gurock TestRail before 7.2.4 mishandles HTML escaping...

CVE-2021-44263

Gurock TestRail before 7.2.4 mishandles HTML escaping...

CVE-2021-44263

CVE-2021-44263 affects Gurock TestRail before 7.2.4. The root cause is improper HTML escaping, leading to a cross-site scripting (XSS) vulnerability in the web-based test case management software. Affected versions prior to 7.2.4 are susceptible; the issue enables injected HTML/JavaScript content...

CVE-2021-44263: Improper Neutralization of Input During Web Page Generation

Gurock TestRail before 7.2.4 mishandles HTML escaping...

PT-2021-24074

Name of the Vulnerable Software and Affected Versions: Gurock TestRail versions prior to 7.2.4 Description: The issue is related to the mishandling of HTML escaping. Recommendations: For versions prior to 7.2.4, update to version 7.2.4 or later to resolve the issue...

Gurock Software Gurock TestRail 跨站脚本漏洞

Gurock Software Gurock TestRail is a web-based test case management software for QA and development teams from Gurock Software. The software supports the creation of test cases, management of test suites, and coordination of the testing process. A cross-site scripting vulnerability exists in Guro...

Gurock Testrail 7.2.0.3014 Improper Access Control

Exploit Title: Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control Date: 22/09/2022 Exploit Author: Sick Codes & JohnJHacking Sakura Samuraii Vendor Homepage: https://www.gurock.com/testrail/ Version: 7.2.0.3014 and below Tested on: macOS, Linux, Windows CVE : CVE-2021-40875 Referenc...

Gurock Testrail 7.2.0.3014 - (files.md5) Improper Access Control Vulnerability

Exploit Title: Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control Exploit Author: Sick Codes & JohnJHacking Sakura Samuraii Vendor Homepage: https://www.gurock.com/testrail/ Version: 7.2.0.3014 and below Tested on: macOS, Linux, Windows CVE : CVE-2021-40875 Reference:...

Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control

Exploit Title: Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control Date: 22/09/2022 Exploit Author: Sick Codes & JohnJHacking Sakura Samuraii Vendor Homepage: https://www.gurock.com/testrail/ Version: 7.2.0.3014 and below Tested on: macOS, Linux, Windows CVE : CVE-2021-40875 Referenc...

CVE-2021-40875

Improper Access Control in Gurock TestRail versions 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The...

CVE-2021-40875

Improper Access Control in Gurock TestRail versions 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The...