Intland

Codebeamer

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2023-4296

  • EPSS 1.05%
  • Veröffentlicht 29.08.2023 22:15:09
  • Zuletzt bearbeitet 13.02.2025 17:17:17

​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.

7.5

CVE-2020-26515

Exploit
  • EPSS 0.07%
  • Veröffentlicht 08.06.2021 13:15:07
  • Zuletzt bearbeitet 21.11.2024 05:19:58

An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the application contains the encrypted user's credentials. However, due to a bug in the applicat...

8.8

CVE-2020-26516

Exploit
  • EPSS 0.22%
  • Veröffentlicht 08.06.2021 13:15:07
  • Zuletzt bearbeitet 21.11.2024 05:19:58

A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and can therefore be entirely predicted allowing attackers to cause the victim's browser to exec...

4.8

CVE-2020-26517

Exploit
  • EPSS 0.31%
  • Veröffentlicht 08.06.2021 13:15:07
  • Zuletzt bearbeitet 21.11.2024 05:19:58

A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project (Authn users), using the users import functio...

5.5

CVE-2020-26513

Exploit
  • EPSS 0.24%
  • Veröffentlicht 07.12.2020 16:15:12
  • Zuletzt bearbeitet 21.11.2024 05:19:56

An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML External Entit...

6.1

CVE-2019-20635

  • EPSS 0.39%
  • Veröffentlicht 02.04.2020 16:15:14
  • Zuletzt bearbeitet 21.11.2024 04:38:55

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields.

4.8

CVE-2019-19912

Exploit
  • EPSS 0.25%
  • Veröffentlicht 30.03.2020 22:15:13
  • Zuletzt bearbeitet 21.11.2024 04:35:38

In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting (XSS) vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF file.

4.8

CVE-2019-19913

Exploit
  • EPSS 0.32%
  • Veröffentlicht 30.03.2020 22:15:13
  • Zuletzt bearbeitet 21.11.2024 04:35:39

In Intland codeBeamer ALM 9.5 and earlier, there is stored XSS via the Trackers Title parameter.