CVE Program partner

BlackDuck

Black Duck Software, Inc.

API
CVEs, 365 days616 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationBlack Duck Software, Inc.
RoleCNA
TypeVendor, Researcher
Reports tomitre
ScopeAll Black Duck (formerly Synopsys Software Integrity Group) products, as well as vulnerabilities in third-party software discovered by Black Duck that are not in another CNA’s scope.
Advisorieshttps://www.blackduck.com/blog/category.cyrc.html#1

Latest CVEs · RSS

  • CVE-2026-76055 2026-08-24 · CVSS 7.5
    Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor ab
  • CVE-2026-76054 2026-08-24 · CVSS 7.1
    Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the sca
  • CVE-2026-8338 2026-07-29 · CVSS 9.2
    A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat
  • CVE-2026-8339 2026-07-29 · CVSS 8.7
    A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat
  • CVE-2026-1496 2026-03-27 · CVSS 9.3
    Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication
  • CVE-2025-0504 2025-11-21 · CVSS 5.3
    Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with
  • CVE-2024-12021 2025-03-31 · CVSS 8.5
    Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may res
  • CVE-2024-12245 2025-03-14 · CVSS 8.7
    Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can
  • CVE-2024-12020 2025-03-14 · CVSS 6.4
    There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into c
  • CVE-2024-12019 2025-03-14 · CVSS 7.1
    The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying
  • CVE-2024-54449 2025-03-14 · CVSS 8.7
    The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with control
  • CVE-2024-54448 2025-03-14 · CVSS 8.6
    The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with admini
  • CVE-2024-54447 2025-03-14 · CVSS 7.1
    Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker
  • CVE-2024-54446 2025-03-14 · CVSS 7.1
    Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the atta
  • CVE-2024-54445 2025-03-14 · CVSS 8.7
    Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can
  • CVE-2024-11144 2024-12-16 · CVSS 7.5
    The server lacks thread safety and can be crashed by anomalous data sent by an anonymous user from a remote network. The crash causes the FTP service to become

All CVE Program partners