Black Duck vulnerabilities
We track 6 vulnerabilities in Black Duck products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on August 24, 2026.
Latest Black Duck vulnerabilities
- 7.5 High severity
blackduck-c-cpp: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the a
- 7.1 High severity
blackduck-c-cpp: Invocation of Process Using Visible Sensitive Information
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which i
- 8.7 High severity
Coverity Connect: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and ot
- 9.2 Critical severity
Coverity Connect: Authentication Bypass Using an Alternate Path or Channel
A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authoriza
- 9.3 Critical severity
Coverity: Authorization Bypass Through User-Controlled Key
Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a val
- 8.5 High severity
Coverity: Improper Neutralization of Input During Web Page Generation
Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may result in the compromise of local accounts managed by the Coverity platform as well as other standard i