Perforce
25 CVEs across 21 Perforce products. Browse Perforce vulnerabilities, severities, and proof-of-concept exploits.
Perforce products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14254 | | 2026-07-16 | A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requ… | |
CVE-2026-8804 | | 2026-07-03 | Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the r… | |
CVE-2026-6902 | | 2026-05-18 | A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential securit… | |
CVE-2026-6043 | | 2026-04-24 | P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to c… | |
CVE-2025-14591 | High | 7.5 | 2025-12-20 | In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) charact… |
CVE-2025-13472 | | 2025-12-03 | A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential ID… | |
CVE-2025-10360 | | 2025-09-24 | In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the fil… | |
CVE-2025-5459 | High | 8.8 | 2025-06-26 | A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It a… |
CVE-2025-3113 | | 2025-04-17 | A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the applicatio… | |
CVE-2025-2903 | | 2025-04-17 | An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining… | |
CVE-2024-11084 | | 2025-04-15 | Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists. | |
CVE-2025-1714 | | 2025-03-05 | Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid user emails and pote… | |
CVE-2024-5250 | Low | 3.5 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations |
CVE-2024-5249 | Medium | 5.4 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. |
CVE-2024-3930 | Medium | 6.3 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. |
CVE-2024-3995 | | 2024-06-28 | In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins. | |
CVE-2024-0325 | Low | 3.6 | 2024-02-01 | In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins. |
CVE-2023-5759 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Reported by Jason Geffner. |
CVE-2023-45849 | Critical | 9.0 | 2023-11-08 | An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner. |
CVE-2023-45319 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner. |
CVE-2023-35767 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Jason Geffner… |
CVE-2022-2394 | Medium | 4.1 | 2022-07-19 | Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, s… |
CVE-2021-28973 | Medium | 4.9 | 2021-04-13 | The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configur… |
CVE-2013-1410 | Medium | 6.1 | 2020-02-12 | Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities |
CVE-2018-1000147 | Medium | 6.5 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows att… |
CVE-2015-8965 | Critical | 9.8 | 2017-04-06 | Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test… |
CVE-2010-0935 | | 2010-03-05 | Perforce Server 2009.2 and earlier, when the protection table is empty, allows remote authenticated users to obtain super privileges via a "p4 protect" command. | |
CVE-2010-0934 | | 2010-03-05 | The triggers functionality in Perforce Server 2008.1 allows remote authenticated users with super privileges to execute arbitrary operating-system commands by… | |
CVE-2010-0933 | | 2010-03-05 | Directory traversal vulnerability in Perforce Server 2008.1 allows remote authenticated users to create arbitrary files via a .. (dot dot) in the argument to t… | |
CVE-2010-0932 | | 2010-03-05 | The FTP server in Perforce Server 2008.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain MKD com… | |
CVE-2010-0931 | | 2010-03-05 | The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (daemon crash) via crafted data, possibly involvi… | |
CVE-2010-0930 | | 2010-03-05 | The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (infinite loop) via crafted data that includes a… | |
CVE-2010-0929 | | 2010-03-05 | The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (daemon crash) via crafted data beginning with a… | |
CVE-2008-1338 | | 2008-03-14 | The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a server-Di… | |
CVE-2008-1303 | | 2008-03-12 | The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a missing p… | |
CVE-2008-1302 | | 2008-03-12 | The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a (1) serve… | |
CVE-2007-6349 | | 2007-12-20 | P4Webs.exe in Perforce P4Web 2006.2 and earlier, when running on Windows, allows remote attackers to cause a denial of service (CPU consumption) via an HTTP re… | |
CVE-2007-0100 | | 2007-01-08 | The Perforce client does not restrict the set of files that it overwrites upon receiving a request from the server, which allows remote attackers to overwrite… |