Testlink
by Testlink
Source repositories
CVEs (31)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-12273 | Hig | 0.00 | 7.5 | 0.01 | Apr 27, 2020 | In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials. | ||
| CVE-2020-8638 | Cri | 0.00 | 9.8 | 0.02 | Apr 3, 2020 | A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter. | ||
| CVE-2020-8637 | Cri | 0.00 | 9.8 | 0.03 | Apr 3, 2020 | A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter. | ||
| CVE-2019-20107 | Hig | 0.00 | 8.8 | 0.02 | Mar 5, 2020 | Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id… | ||
| CVE-2020-8841 | Hig | 0.00 | 8.8 | 0.01 | Feb 10, 2020 | An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection. | ||
| CVE-2014-8082 | 0.00 | — | 0.03 | Oct 31, 2014 | lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, which reveals the installation path in an error message. | |||
| CVE-2014-8081 | 0.00 | — | 0.04 | Oct 31, 2014 | lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter_result_result parameter. | |||
| CVE-2012-0939 | 0.00 | — | 0.01 | Aug 14, 2014 | Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in… | |||
| CVE-2012-2275 | 0.00 | — | 0.03 | Sep 15, 2012 | Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an… | |||
| CVE-2008-5807 | 0.00 | — | 0.01 | Dec 31, 2008 | Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php, and possibly (3) Testcaseprefixes in projectview.tpl. | |||
| CVE-2007-6006 | 0.00 | — | 0.01 | Nov 15, 2007 | TestLink before 1.7.1 does not enforce an unspecified authorization mechanism, which has unknown impact and attack vectors. |
- risk 0.00cvss 7.5epss 0.01
In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.
- risk 0.00cvss 9.8epss 0.02
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter.
- risk 0.00cvss 9.8epss 0.03
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter.
- risk 0.00cvss 8.8epss 0.02
Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id…
- risk 0.00cvss 8.8epss 0.01
An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection.
- CVE-2014-8082Oct 31, 2014risk 0.00cvss —epss 0.03
lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, which reveals the installation path in an error message.
- CVE-2014-8081Oct 31, 2014risk 0.00cvss —epss 0.04
lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter_result_result parameter.
- CVE-2012-0939Aug 14, 2014risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in…
- CVE-2012-2275Sep 15, 2012risk 0.00cvss —epss 0.03
Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an…
- CVE-2008-5807Dec 31, 2008risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php, and possibly (3) Testcaseprefixes in projectview.tpl.
- CVE-2007-6006Nov 15, 2007risk 0.00cvss —epss 0.01
TestLink before 1.7.1 does not enforce an unspecified authorization mechanism, which has unknown impact and attack vectors.
Page 2 of 2