Synopsys
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Synopsys Jenkins Coverity Plugin | 3 | – | Feb 15, 2023 |
| Coverity | 2 | – | Mar 29, 2023 |
| Black Duck Hub | 1 | – | May 10, 2022 |
| Code Dx | 1 | – | Apr 27, 2023 |
| Seeker | 1 | – | Jan 9, 2024 |
Exploited and recent CVEs
- CVE-2024-0226 Stored Cross-Site Scripting in Synopsys Seeker 0.3%
- CVE-2023-2158 Impersonation through User-Controlled Token 0.6%
- CVE-2023-1663 Authenticated Resources Accessible via Forced Browsing 0.4%
- CVE-2023-23847 A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified creden 0.4%
- CVE-2023-23850 A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. 0.5%
- CVE-2023-23848 Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified cr 0.5%
- CVE-2023-23849 Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole su 1.3%
- CVE-2022-30278 A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to impro 0.8%