WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product testlink✕
Overview 14 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
14matches 2in Waratek scope14.3% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 3public PoC21.4% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 14.3% Outside Waratek scope 0 0.0% Not applicable 12 85.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 14 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 21.4% Proof of concept only 1 7.1% Forecast only 0 0.0% No public exploit 10 71.4%
split by peak 3 / year
Not applicable: 12No exploit published: 2 Medium: 14 not blocked: 14 No public exploit: 10Proof of concept only: 1Working exploit published: 3
20081 Not applicable1 Medium1 not blocked1 No public exploit1 20091 Not applicable1 Medium1 not blocked1 Working exploit published1 20100 20110 20121 Not applicable1 Medium1 not blocked1 Working exploit published1 20130 20143 Not applicable3 Medium3 not blocked3 Working exploit published1 No public exploit2 20150 20160 20171 Not applicable1 Medium1 not blocked1 No public exploit1 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20193 No exploit published1 Not applicable2 Medium3 not blocked3 No public exploit3 20201 Not applicable1 Medium1 not blocked1 No public exploit1 20210 20221 Not applicable1 Medium1 not blocked1 No public exploit1 20230 20241 Not applicable1 Medium1 not blocked1 Proof of concept only1
200820102012201420162018202020222024
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-42906 Medium 2024-08-26 Not applicable Proof of concept only TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload can be entered into the file name.
CVE-2022-35194 Medium 2022-09-16 Not applicable No public exploit TestLink v1.9.20 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /lib/inventory/inventoryView.php.
CVE-2019-20381 Medium 2020-01-20 Not applicable No public exploit TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491.
CVE-2019-19491 Medium 2019-12-02 Not applicable No public exploit TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request.
CVE-2019-10378 Medium 2019-08-07 No exploit published No public exploit Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVE-2019-14471 Medium 2019-08-01 Not applicable No public exploit TestLink 1.9.19 has XSS via the error.php message parameter.
CVE-2018-1000113 Medium 2018-03-13 No exploit published No public exploit A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker who can control e.g. TestLink report names to have Jenkins serve arbitrary HTML and JavaScript
CVE-2015-7391 Medium 2017-09-26 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php.
CVE-2014-8082 Medium 2014-10-31 Not applicable No public exploit lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, which reveals the installation path in an error message.
CVE-2012-0939 Medium 2014-08-14 Not applicable No public exploit Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in requirements/. NOTE: some of these details are obtained from third party information.
CVE-2012-0938 Medium 2014-08-14 Not applicable Working exploit published Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the root_node parameter in the display_children function to (1) getrequirementnodes.php or (2) gettprojectnodes.php in lib/ajax/; the (3) cfield_id parameter in an edit action to lib/cfields/cfieldsEdit.php; the (4) id parameter in an edit action or (5) plan_id parameter in a create action to lib/plan/planMilestonesEdit.php; or the req_spec_id parameter to (6) reqImport.php or (7) in a create action to reqEdit.php in lib/requirements/. NOTE: some of these details are obtained from third party information.
CVE-2012-2275 Medium 2012-09-15 Not applicable Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.
CVE-2009-4238 Medium 2009-12-10 Not applicable Working exploit published Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Case ID field to lib/general/navBar.php or (2) the logLevel parameter to lib/events/eventviewer.php.
CVE-2008-5807 Medium 2008-12-31 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php, and possibly (3) Testcaseprefixes in projectview.tpl.