15 matches found
PT-2026-69101
Name of the Vulnerable Software and Affected Versions TestLink versions prior to 1.9.21 Description An insecure direct object reference IDOR exists where authenticated users, including those with low-privilege guest accounts, can read arbitrary attachments. By providing an integer attachment ID t...
CVE-2026-70561: Authorization Bypass Through User-Controlled Key
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...
CVE-2022-35195
TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php...
CVE-2022-35195
TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php...
Improper access control
TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php...
CVE-2022-35195
TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php...
CVE-2022-35195
TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php...
PT-2022-22626
Name of the Vulnerable Software and Affected Versions TestLink version 1.9.20 Raijin Description A broken access control issue was found in TestLink at the "/lib/attachments/attachmentdownload.php" API endpoint. Recommendations For TestLink version 1.9.20 Raijin, consider restricting access to th...
CVE-2022-35195: Undefined Security Weakness
TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php...
Code injection
TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload.php...
CVE-2018-7668
TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload.php...
CVE-2018-7668
TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload.php...
PT-2018-18197
Name of the Vulnerable Software and Affected Versions TestLink versions prior to 1.9.17 Description The issue allows remote attackers to read arbitrary attachments by modifying the ID field in the /lib/attachments/attachmentdownload.php endpoint. Recommendations For versions prior to 1.9.17, upda...
CVE-2018-7668: Exposure of Sensitive Information to an Unauthorized Actor
TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload.php...