CVE-2024-48590

Inflectra SpiraTeam 7.2.00 is vulnerable to a Server-Side Request Forgery (SSRF) via the NewsReaderService component. A remote attacker can send specially crafted requests to this service, forcing the server to make unintended requests, which can lead to the capture of authentication hashes from ...

CVE-2024-48591

Inflectra SpiraTeam version 7.2.00 is vulnerable to Cross-Site Scripting (XSS) via the TestRuns section. An attacker can upload a specially crafted SVG file containing JavaScript; when a user views this file directly in their browser, the script executes. This vulnerability could potentially lead...