CVE-2007-5289

HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\TD_80, and then setting the file's properties to read-only.

• CWE-264

• http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/
• http://secunia.com/advisories/34015Vendor Advisory
• http://secunia.com/advisories/34046
• http://www.kb.cert.org/vuls/id/898865US Government Resource
• http://www.securityfocus.com/archive/1/501177/100/0/threaded
• http://www.securityfocus.com/archive/1/501219/100/0/threaded
• http://www.securityfocus.com/bid/33854
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48860
• http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/
• http://secunia.com/advisories/34015Vendor Advisory
• http://secunia.com/advisories/34046
• http://www.kb.cert.org/vuls/id/898865US Government Resource
• http://www.securityfocus.com/archive/1/501177/100/0/threaded
• http://www.securityfocus.com/archive/1/501219/100/0/threaded
• http://www.securityfocus.com/bid/33854
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48860

Published

Feb 24, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-5283The TSC Domain Manager in Hitachi TPBroker Object Transactio…
• CVE-2007-5284Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2007-5285Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2007-5286Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2007-5287Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2007-5288Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2007-5290Multiple cross-site scripting (XSS) vulnerabilities in MailB…
• CVE-2007-5291Cross-site scripting (XSS) vulnerability in Edit.asp in DB M…
• CVE-2007-5292Cross-site scripting (XSS) vulnerability in photos.cfm in Di…
• CVE-2007-5293Multiple cross-site scripting (XSS) vulnerabilities in IDMOS…
• CVE-2007-5294PHP remote file inclusion vulnerability in core/aural.php in…
• CVE-2007-5295Multiple cross-site scripting (XSS) vulnerabilities in index…