CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1663 – Authenticated Resources Accessible via Forced Browsing
https://notcve.org/view.php?id=CVE-2023-1663
29 Mar 2023 — Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vulnerability is an insecurely configured servlet mapping for the underlying Apache Tomcat server. As a result, the downloads directory and its contents are accessible. 5.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C) Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthoriz... • https://community.synopsys.com/s/article/Mitigation-for-Coverity-Platforms-Exposure-to-CVE-2023-1663 • CWE-425: Direct Request ('Forced Browsing') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23849
https://notcve.org/view.php?id=CVE-2023-23849
06 Feb 2023 — Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious purposes. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/RL:O/RC:C • https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2023-23849-affecting-Coverity • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •