Coverity Connect
Monthly
SQL injection in the Coverity Connect SOAP API (versions 2024.6.0 through 2026.3.0 inclusive) lets an authenticated attacker submit a crafted SOAP payload to read the entire backing database and issue other unauthorized SQL commands. Rated CVSS 4.0 8.7 (High) and reported through a Black Duck product security advisory, it requires only low-privilege authentication and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the Coverity Connect SOAP API (versions 2024.6.0 through 2026.3.0 inclusive) lets an authenticated attacker submit a crafted SOAP payload to read the entire backing database and issue other unauthorized SQL commands. Rated CVSS 4.0 8.7 (High) and reported through a Black Duck product security advisory, it requires only low-privilege authentication and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.