CVE-2023-32266

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation.

This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:L/U:Clear

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
OpenText™	Application Lifecycle Management (ALM),Quality Center	15.00; 15.01; 15.01 P1; 15.01 P2; 15.01 P3; 15.01 P4; 15.01 P5; 15.51; 15.51 P1; 15.51 P2; 15.51 P3; 16.00; 16.01 P1
opentext	alm_quality_center	15.00; 15.01; 15.01_p1; 15.01_p2; 15.01_p3; 15.01_p4; 15.01_p5; 15.51; 15.51_p1; 15.51_p2; 15.51_p3; 16.00; 16.01_p1

References

https://portal.microfocus.com/s/article/KM000024386?language=en_US

Timeline

Published: Oct 16, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-322678.8A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Management Center. The vulnerability could be remotely expl CVE-2023-322687.2Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credentials of proxy adminis CVE-2023-322696.7An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allow CVE-2023-32275.7Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.CVE-2023-322707.8Access of memory location after end of buffer issue exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 fil CVE-2023-322716.5An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Plat CVE-2023-322725.5Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0.0.6 may allow an aut CVE-2023-322737.8Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM2 file may le CVE-2023-322747.5Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exp CVE-2023-322754.4An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially craf CVE-2023-322767.8Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 file may lead CVE-2023-322776.1Untrusted Pointer Dereference in I/O subsystem for some Intel(R) QAT software before version 2.0.5 may allow authenticated user to potential