Black Duck
Monthly
Command injection in Black Duck blackduck-c-cpp before version 3.0.7 enables any actor with write access to a scanned build directory to execute arbitrary OS commands as the account running the scan. The scanner's package manager component traverses the build directory and incorporates discovered filesystem paths into shell command strings without quoting or escaping, making any file or directory whose name contains shell metacharacters an effective injection vector. No public exploit code or active exploitation is confirmed at time of analysis, but the mechanic is standard shell injection requiring no specialized tooling, making this a meaningful risk in shared CI/CD environments where untrusted parties can write to scanned directories.
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.
SQL injection in the Coverity Connect SOAP API (versions 2024.6.0 through 2026.3.0 inclusive) lets an authenticated attacker submit a crafted SOAP payload to read the entire backing database and issue other unauthorized SQL commands. Rated CVSS 4.0 8.7 (High) and reported through a Black Duck product security advisory, it requires only low-privilege authentication and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Coverity Connect command-line tooling authentication bypass via /token API endpoint allows remote attackers to assume valid user credentials and privileges without proper authentication when a username is known or guessed. The vulnerability stems from missing error handling in authentication logic, enabling attackers to craft specialized HTTP requests that circumvent normal access controls and grant full role-based privileges of the compromised account. No public exploit code or active exploitation has been confirmed at this time.
Command injection in Black Duck blackduck-c-cpp before version 3.0.7 enables any actor with write access to a scanned build directory to execute arbitrary OS commands as the account running the scan. The scanner's package manager component traverses the build directory and incorporates discovered filesystem paths into shell command strings without quoting or escaping, making any file or directory whose name contains shell metacharacters an effective injection vector. No public exploit code or active exploitation is confirmed at time of analysis, but the mechanic is standard shell injection requiring no specialized tooling, making this a meaningful risk in shared CI/CD environments where untrusted parties can write to scanned directories.
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.
SQL injection in the Coverity Connect SOAP API (versions 2024.6.0 through 2026.3.0 inclusive) lets an authenticated attacker submit a crafted SOAP payload to read the entire backing database and issue other unauthorized SQL commands. Rated CVSS 4.0 8.7 (High) and reported through a Black Duck product security advisory, it requires only low-privilege authentication and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Coverity Connect command-line tooling authentication bypass via /token API endpoint allows remote attackers to assume valid user credentials and privileges without proper authentication when a username is known or guessed. The vulnerability stems from missing error handling in authentication logic, enabling attackers to craft specialized HTTP requests that circumvent normal access controls and grant full role-based privileges of the compromised account. No public exploit code or active exploitation has been confirmed at this time.