disclosure@synopsys.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS disclosure@synopsys.com
03
assessed vulnerabilities (30)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-76055US | — | — | ||
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file… | ||||
| CVE-2026-76054US | — | — | ||
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build… | ||||
| CVE-2026-8339US | — | — | ||
A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who sends a sp… | ||||
| CVE-2026-8338US | —OT elevated | — | ||
A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send… | ||||
| CVE-2026-1496US | — | — | ||
Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious… | ||||
| CVE-2025-0504US | — | — | ||
Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read… | ||||
| CVE-2024-12021US | — | — | ||
Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may result in the compromis… | ||||
| CVE-2024-54449US | high8.8 | — | ||
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an a… | ||||
| CVE-2024-54448US | high7.2 | — | ||
The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges o… | ||||
| CVE-2024-54447US | — | — | ||
Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all da… | ||||
| CVE-2024-54446US | — | — | ||
Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose al… | ||||
| CVE-2024-54445US | — | — | ||
Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all databas… | ||||
| CVE-2024-12245US | — | — | ||
Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all databa… | ||||
| CVE-2024-12020US | medium6.1 | — | ||
There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into clicking a crafted li… | ||||
| CVE-2024-12019US | — | — | ||
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. A… | ||||
| CVE-2024-11144US | — | — | ||
The server lacks thread safety and can be crashed by anomalous data sent by an anonymous user from a remote network. The crash causes the FTP service to become unavailable, affecti… | ||||
| CVE-2024-8796US | medium5.3 | — | ||
Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Us… | ||||
| CVE-2024-5184US | critical9.1 | — | ||
The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take over the service log… | ||||
| CVE-2024-5185US | — | — | ||
The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromised, leading to unautho… | ||||
| CVE-2024-0226US | medium5.4 | — | ||
Synopsys Seeker versions prior to 2023.12.0 are vulnerable to a stored cross-site scripting vulnerability through a specially crafted payload. | ||||