Page 2 of 19 results (0.040 seconds)

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 3

CVE-2014-8082 – TestLink 1.9.12 Path Disclosure

https://notcve.org/view.php?id=CVE-2014-8082

23 Oct 2014 — lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, which reveals the installation path in an error message. lib/functions/database.class.php en TestLink anterior a 1.9.13 permite a atacantes remotos obtener información sensible a través de vectores no especificados, lo que revela la ruta de instalación en un mensaje de error. TestLink versions 1.9.12 and below suffer from a path disclosure weakness. • http://karmainsecurity.com/KIS-2014-12 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.0EPSS: 14%CPEs: 1EXPL: 8

CVE-2014-5308 – TestLink 1.9.11 - Multiple SQL Injections

https://notcve.org/view.php?id=CVE-2014-5308

01 Oct 2014 — Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php. Múltiples vulnerabilidades de inyección SQL en TestLink 1.9.11 permiten a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro (1) name en una acción de búsquedaen lib/project/projectView.php o (2) id en lib/events/eventinfo.ph... • https://packetstorm.news/files/id/128521 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 29%CPEs: 2EXPL: 0

CVE-2012-0938

https://notcve.org/view.php?id=CVE-2012-0938

14 Aug 2014 — Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the root_node parameter in the display_children function to (1) getrequirementnodes.php or (2) gettprojectnodes.php in lib/ajax/; the (3) cfield_id parameter in an edit action to lib/cfields/cfieldsEdit.php; the (4) id parameter in an edit action or (5) plan_id parameter in a create action to lib/plan/planMilestonesEdit.php; or the req_... • http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2012-0939

https://notcve.org/view.php?id=CVE-2012-0939

14 Aug 2014 — Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in requirements/. NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de inyección SQL en TestLink 1.8.5b y anteriores permiten a usuarios remotos autenticados con el permiso de visualizació... • http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 0%CPEs: 17EXPL: 8

CVE-2012-2275 – TestLink 1.9.3 - Cross-Site Request Forgery

https://notcve.org/view.php?id=CVE-2012-2275

15 Sep 2012 — Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en TestLink v1.9.3 y anteriores permite a atacantes remotos secuestrar la autenticación de los usuarios para petici... • https://www.exploit-db.com/exploits/21135 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 8.8EPSS: 1%CPEs: 15EXPL: 3

CVE-2009-4238 – TestLink Test Management and Execution System - Multiple Cross-Site Scripting / Injection Vulnerabilities

https://notcve.org/view.php?id=CVE-2009-4238

10 Dec 2009 — Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Case ID field to lib/general/navBar.php or (2) the logLevel parameter to lib/events/eventviewer.php. Múltiples vulnerabilidades de inyección SQL en TestLink en versiones anteriores a v1.8.5 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de (1) el campo "ID de caso de prueba" a lib/general/navBar.php o (2) el parámetro "logLeve... • https://www.exploit-db.com/exploits/10364 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 5.4EPSS: 1%CPEs: 9EXPL: 3

CVE-2009-4237 – TestLink Test Management and Execution System - Multiple Cross-Site Scripting / Injection Vulnerabilities

https://notcve.org/view.php?id=CVE-2009-4237

10 Dec 2009 — Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the req parameter to login.php, and allow remote authenticated users to inject arbitrary web script or HTML via (2) the key parameter to lib/general/staticPage.php, (3) the tableName parameter to lib/attachments/attachmentupload.php, or the (4) startDate, (5) endDate, or (6) logLevel parameter to lib/events/eventviewer.php; (7) the search_notes_string parameter t... • https://www.exploit-db.com/exploits/10364 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0

CVE-2008-5807

https://notcve.org/view.php?id=CVE-2008-5807

31 Dec 2008 — Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php, and possibly (3) Testcaseprefixes in projectview.tpl. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en TestLink v1.8 RC1 y anteriores permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante (1) Testproject Names y (2) Testplan Names ... • http://secunia.com/advisories/32599 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2007-6006

https://notcve.org/view.php?id=CVE-2007-6006

15 Nov 2007 — TestLink before 1.7.1 does not enforce an unspecified authorization mechanism, which has unknown impact and attack vectors. TestLink anterior a 1.7.1 no hace cumplir un mecanismo de autorización no especificado, lo cual tiene impacto y vectores de ataque desconocidos. • http://osvdb.org/42211 • CWE-287: Improper Authentication •