289 matches found
GHSA-FC3J-CFQV-PFRM Password stored in plain text by Jenkins HP ALM Quality Center Plugin
HP ALM Quality Center Plugin 1.6 and earlier stores a password in plain text in its global configuration file org.jenkinsci.plugins.qc.QualityCenterIntegrationRecorder.xml. This password can be viewed by users with access to the Jenkins controller file system...
GHSA-QGP8-H5CP-R75R Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation
Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service. Bumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation...
Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation
Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service. Bumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation...
Siemens Polarion ALM Cross-Site Scripting Vulnerability
Polarion WebClient for SVN is an SVN client. A cross-site scripting vulnerability exists in Siemens Polarion ALM, which can be exploited by an attacker to execute arbitrary code and extract sensitive information by sending a crafted link to a user with administrator privileges...
CVE-2021-44478
A vulnerability has been identified in Polarion ALM All versions V21 R2 P2, Polarion WebClient for SVN All versions. A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to...
CVE-2021-44478
A vulnerability has been identified in Polarion ALM All versions V21 R2 P2, Polarion WebClient for SVN All versions. A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to...
Cross site scripting
A vulnerability has been identified in Polarion ALM All versions V21 R2 P2, Polarion WebClient for SVN All versions. A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to...
CVE-2021-44478
CVE-2021-44478 affects Siemens Polarion ALM and its SVN WebClient: Cross-Site Scripting due to improper neutralization of data sent to web pages in the SVN WebClient. Affected: Polarion ALM (all versions prior to v21 R2 P2) and Polarion WebClient for SVN (all versions). Impact: could allow an att...
CVE-2021-44478
A vulnerability has been identified in Polarion ALM All versions V21 R2 P2, Polarion WebClient for SVN All versions. A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to...
Siemens Polarion ALM
1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Polarion ALM Vulnerability: Cross-site Scripting 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-22-069-08 Siemens Polarion ALM that...
Enalean Tuleap Open Alm SQL注入漏洞
Enalean Tuleap Open Alm is a free and open source tool from Enalean France. for end-to-end traceability of application and system development. An SQL injection vulnerability exists in Enalean Tuleap Open Alm, which stems from the fact that Tuleap does not properly clean up user input when...
Enalean Tuleap Open Alm SQL注入漏洞
Enalean Tuleap Open Alm is a free and open source tool from Enalean France. for end-to-end traceability of application and system development. A SQL injection vulnerability exists in Tuleap Open Alm, which allows an attacker with read access to the SVN core repository to execute arbitrary SQL...
CVE-2021-41148
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal...
CVE-2021-41147
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute...
Sql injection
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal...
CVE-2021-41148
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal...
Sql injection
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute...
CVE-2021-41147
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute...
CVE-2021-41148 The update of the CI job targeted by a widget is vulnerable to blind SQL injections
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal...