Perforce vulnerabilities, page 2
46 vulnerabilities
Known vulnerabilities in Perforce products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
CVE-2010-0934perforceperforce_server
EPSS score2.00%
The triggers functionality in Perforce Server 2008.1 allows remote authenticated users with super privileges to execute arbitrary operating-system commands by using a "p4 client" command in conjunction with the form-in trigger script.CVE-2010-0929perforceperforce_serverEPSS score1.14%
The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (daemon crash) via crafted data beginning with a byte sequence of 0x4c, 0xb3, 0xff, 0xff, and 0xff.CVE-2010-0931perforceperforce_serverEPSS score1.14%
The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (daemon crash) via crafted data, possibly involving a large sndbuf value.CVE-2010-0932perforceperforce_serverEPSS score1.67%
The FTP server in Perforce Server 2008.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain MKD command.CVE-2010-0935perforceperforce_serverEPSS score1.57%
Perforce Server 2009.2 and earlier, when the protection table is empty, allows remote authenticated users to obtain super privileges via a "p4 protect" command.CVE-2010-0930perforceperforce_serverEPSS score1.14%
The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (infinite loop) via crafted data that includes a byte sequence of 0xdc, 0xff, 0xff, and 0xff immediately before the client protocol version number.CVE-2024-11084perforcehelix_almEPSS score0.46%
Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists.CVE-2024-0325helixsync+1EPSS score0.75%
In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins.CVE-2024-5250akanaakana api platform+1EPSS score0.30%
In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrationsCVE-2024-5249akanaakana api platform+1EPSS score0.22%
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed.CVE-2024-3995perforcehelix_almEPSS score0.61%
In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins.CVE-2024-3930akanaakana api platform+1EPSS score0.31%
In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered.CVE-2026-103510perforcep4 (helix core)EPSS score0.35%
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.CVE-2026-103511perforcep4 (helix core)EPSS score0.33%
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.CVE-2026-103512perforcep4 (helix core)EPSS score0.37%
Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.CVE-2026-103507perforcep4 (helix core)EPSS score0.51%
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account.CVE-2026-89212perforceakanaEPSS score0.44%
A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.CVE-2026-100102perforcep4 (helix core)EPSS score0.36%
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.CVE-2026-6043perforcehelix core server (p4d)EPSS score1.25%
P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. These default settings, taken together, can lead to unauthorized access to source code repositories and other managed assets. The 2026.1 release, expected in May 2026, enforces secure-by-default configurations on upgrade and new installationsCVE-2026-6902perforcep4 (helix core)EPSS score0.70%
A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.