CVE-2019-20155

CVE-2019-20155 affects Determine CLM v5.4 (report_edit.jsp). The issue allows an authenticated user to cause Groovy code execution on the server during report generation, enabling arbitrary code execution. Affected component is the report generation flow in report_edit.jsp; root cause is code exe...

CVE-2019-20154

Determine Contract Lifecycle Management (CLM) v5.4 contains a Cross‑Site Scripting (XSS) vulnerability in multiple getchart.jsp parameters, enabling remote attackers to inject arbitrary web script or HTML. The affected component is CLM 5.4; root cause stems from inadequate input validation in get...

CVE-2019-20153

CVE-2019-20153 concerns Determine Contract Lifecycle Management (CLM) v5.4, where an XML External Entity (XXE) flaw in the upload definition feature (definition_upload_attach.jsp) allows authenticated remote attackers to read arbitrary files, including configuration files with administrative cred...

CVE-2019-20153: Improper Restriction of XML External Entity Reference

An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM in v5.4. An XML external entity XXE vulnerability in the upload definition feature in definitionuploadattach.jsp allows authenticated remote attackers to read arbitrary files including configuration files...