CVE-2023-23849

Versions of Synopsys Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting (XSS) vulnerability. The root cause allows any web service hosted on the same subdomain to set a cookie for the entire subdomain, which can be leveraged to bypass existing security m...

CVE-2023-1663

CVE-2023-1663 affects Coverity Connect prior to 2023.3.2. The root cause is an insecurely configured servlet mapping in the underlying Apache Tomcat, leading to a forced browsing vulnerability where the downloads directory and its contents become accessible to unauthorized actors. Affected softwa...