TestLink Open Source Test Management Insecure Direct Object Reference

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Insecure Direct Object Reference product: TestLink Open Source Test Management vulnerable version: 1.9.17 fixed version: 1.9.17 after November 2017, and the current...

TestLink Injection Vulnerability

TestLink is a WEB-based test case management system. An injection vulnerability exists in install/installNewDB.php in versions 1.9.16 and earlier of TestLink. A remote attacker can exploit this vulnerability by providing a specially crafted long value during the installation process using control...

Stored cross-site scripting vulnerability in TestLink Plugin

Users with Job/Configure permission were able to configure TestLink reports to display arbitrary unescaped HTML e.g. in test case names. The plugin now properly escapes its HTML output...

CVE-2018-7466

install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value...

Design/Logic Flaw

install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value...

CVE-2018-7466

install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value...

CVE-2018-7466

TestLink Open Source Test Management

CVE-2018-7466

install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value...

CVE-2018-7466: Improper Control of Generation of Code

install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value...

TestLink SQL Injection Vulnerability (CNVD-2017-32128)

Testlink is TestLink team developed a PHP-based open source test management tool . The tool provides test requirements management , test case management and test data statistics and other functions . SQL injection vulnerability exists in versions of TestLink before 1.9.14. A remote attacker can...

TestLink Cross-Site Scripting Vulnerability

Testlink is TestLink team developed a PHP-based open source test management tool . The tool provides test requirements management , test case management and test data statistics and other functions . TestLink version before 1.9.14 cross-site scripting vulnerability exists. Remote attackers can us...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...

CVE-2015-7390

SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php...

CVE-2015-7391

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...

Sql injection

SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php...

CVE-2015-7390

SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php...

CVE-2015-7390

CVE-2015-7390 is supported by multiple connected sources detailing a SQL injection in TestLink prior to 1.9.14. The vulnerability allows remote attackers to inject arbitrary SQL via the apikey parameter to lnl.php, potentially compromising the database. Affected version range is before 1.9.14; th...

CVE-2015-7391

TestLink prior to 1.9.14 is affected by multiple XSS vulnerabilities that allow an attacker to inject arbitrary script/HTML via various inputs (selected_end_date, selected_start_date, containerType, filter_tc_id, filter_testcase_name, useRecursion, targetTestCase, created_by) and the Referer head...

CVE-2015-7391

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...

CVE-2015-7390: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php...