CVE-2023-22892

CVE-2023-22892 : In SmartBear Zephyr Enterprise up to version 7.15.0, there exists an information disclosure vulnerability that could be exploited by unauthenticated users to read arbitrary files from Zephyr instances. The provided documents confirm the affected product and the unauthenticated ac...

CVE-2023-22890

CVE-2023-22890 affects SmartBear Zephyr Enterprise up to version 7.15.0. The vulnerability allows unauthenticated users to upload large files, which can exhaust local drive space and cause a denial of service. The provided documents confirm the affected product and the exploit scenario (untrusted...

CVE-2021-41657

SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack...

CVE-2021-41657

SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack...

SmartBear CodeCollaborator 输入验证错误漏洞

SmartBear CodeCollaborator is a code review and documentation review tool from SmartBear. It helps development, testing and management teams to work together to produce high-quality code. A security vulnerability exists in SmartBear CodeCollaborator version v6.1.6102, which stems from a problem...

CVE-2021-41657

SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack...

CVE-2021-41657

SmartBear CodeCollaborator v6.1.6102 contains a web UI vulnerability that enables clickjacking. The affected component is the CodeCollaborator web UI; the underlying issue is an insecure handling of embedded frames that allows an attacker to render a hidden frame and trick an authenticated user i...

PT-2022-11454

Name of the Vulnerable Software and Affected Versions SmartBear CodeCollaborator version 6.1.6102 Description The issue allows an attacker to conduct a clickjacking attack through the web UI. Recommendations For version 6.1.6102, update to a newer version that contains a fix for this issue...

CVE-2020-26118

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit GWT API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious...

CVE-2020-26118

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit GWT API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious...

Deserialization of untrusted data

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit GWT API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious...

CVE-2020-26118

CVE-2020-26118 – SmartBear Collaborator Server : All provided sources describe a post-authentication Java deserialization vulnerability in the server’s UpdateMemento handling of user-supplied serialized objects via the Google Web Toolkit (GWT) API, up to version 13.3.13302. The issue allows an au...

CVE-2020-26118

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit GWT API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious...

CVE-2020-12835

An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network...

Remote code execution

An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network...

CVE-2020-12835

An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network...

CVE-2020-12835

Affected software: SmartBear ReadyAPI SoapUI Pro 3.2.5 (and related jProductivity Protection! licensing components). Issue: unsafe deserialization via a Java RMI-based protocol in an unsafe configuration that allows an attacker to inject malicious serialized objects, leading to remote code execut...

CVE-2019-12180

An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code Java scripting language on the victim machine by inducing it ...

Design/Logic Flaw

An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code Java scripting language on the victim machine by inducing it ...

CVE-2019-12180

An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code Java scripting language on the victim machine by inducing it ...