Siemens Polarion Alm vulnerabilities

10 CVEs affecting Siemens Polarion Alm, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-51447, published 2025-05-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44478, published 2022-03-08. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present due to improper neutralization of data…
CVE-2023-28828, published 2023-04-11. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on…
CVE-2024-23813, published 2024-02-13. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker…
CVE-2024-51444, published 2025-05-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The application insufficiently validates user input for database read queries. This…
CVE-2024-51445, published 2025-05-13. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External Entity Injection (XXE) vulnerability in…
CVE-2024-51447, published 2025-05-13. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affected application contains an observable response…
CVE-2024-33647, published 2024-05-14. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an…
CVE-2022-46265, published 2022-12-13. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vulnerability that could allow an attacker to spoof a Host…
CVE-2024-51446, published 2025-05-13. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affected application improperly sanitizes xml files. This…
CVE-2023-50236, published 2024-02-13. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to weak file and folder permissions in the installation path. An attacker with…