Polarion Alm
Approved changes feed: RSS · Atom
cpe:2.3:a:siemens:polarion_alm:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Siemens (4bd2a91b-02ad-5c3d-b25f-70697e0c9d7f) |
|---|---|
| Product | Polarion Alm (49a74728-be99-5cc6-be26-59c9443b5554) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-51447 |
vulnerable | 2026-06-08 06:52:11.994404 |
Details available
MEDIUM (5.3)
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affected application contains an observable response discrepancy vulnerability when validating usernames. This could allow an unauthenticated remote attacker to distinguish between valid and invalid usernames.
Published: 2025-05-13T09:38:25.452Z
Updated: 2025-05-13T15:57:37.712Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51446 |
vulnerable | 2026-06-08 06:52:11.993863 |
Details available
MEDIUM (6.5)
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affected application improperly sanitizes xml files. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by uploading specially crafted xml files that are later downloaded and viewed by other users of the application.
Published: 2025-05-13T09:38:24.164Z
Updated: 2025-05-13T16:11:11.445Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51445 |
vulnerable | 2026-06-08 06:52:11.993050 |
Details available
MEDIUM (6.5)
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External Entity Injection (XXE) vulnerability in the docx import feature. This could allow an authenticated remote attacker to read arbitrary data from the application server.
Published: 2025-05-13T09:38:22.679Z
Updated: 2025-05-13T19:02:54.611Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51444 |
vulnerable | 2026-06-08 06:52:11.992000 |
Details available
MEDIUM (6.5)
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The application insufficiently validates user input for database read queries. This could allow an authenticated remote attacker to conduct an SQL injection attack that bypasses authorization controls and allows to download any data from the application's database.
Published: 2025-05-13T09:38:21.392Z
Updated: 2025-05-13T19:03:52.314Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-33647 |
vulnerable | 2026-06-08 06:37:31.910166 |
Details available
MEDIUM (6.5)
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.
Published: 2024-05-14T10:03:08.350Z
Updated: 2025-08-27T21:13:00.144Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23813 |
vulnerable | 2026-06-08 06:29:40.500299 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-50236 |
vulnerable | 2026-06-08 06:16:15.724569 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28828 |
vulnerable | 2026-06-08 06:02:36.155951 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46265 |
vulnerable | 2026-06-08 05:50:38.480329 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-44478 |
vulnerable | 2026-06-08 05:36:45.828105 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.