Skip to content
OpenAdvisories

Vendor

Perforce

25 known vulnerabilities.

Products

P4 (Helix Core) 8 Puppet Enterprise 5 Helix ALM 2 Akana 2 Delphix 2 Helix Core Server (P4D) 1 Gliffy 1 Delphix Continuous Data 1 Delphix Continuous Compliance 1 BlazeMeter 1 Puppet Core 1 Helix Authentication Service 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-103511

    Arbitrary file-write via extension installation in P4Search

    Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.

    Perforce P4 (Helix Core)
  • Medium 5.3
    CVE-2026-103512

    Ticket host-binding bypass via spoofed client IP in P4Search

    Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 S…

    Perforce P4 (Helix Core)
  • Medium 6.7
    CVE-2026-8804

    Cleartext Storage of Sensitive Information for Puppet Resource API

    Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transac…

    Perforce Puppet Enterprise Puppet Core ruby-puppet-resource-api Debian Ubuntu
  • Medium 5.3
    CVE-2025-14591

    PII Leak Due to Change in EOR Handling

    In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) characters in delimited files, an issue was identified: using an incorrect EOR configuration can cause inac…

    Perforce Delphix Continuous Compliance
  • Medium 5.3
    CVE-2025-13472

    Missing authorization in BlazeMeter Jenkins Plugin

    A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown o…

    Perforce BlazeMeter com.blazemeter.plugins:BlazeMeterJenkinsPlugin Maven
  • Medium 6.9
    CVE-2025-10360

    Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5

    In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterpr…

    Perforce Puppet Enterprise
  • Medium 6.3
    CVE-2024-11084

    Potential Username Enumeration in Helix ALM

    Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists.

    Perforce Helix ALM
  • Medium 6.9
    CVE-2025-1714

    Username Enumeration in Gliffy

    Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid user emails and potentially DOS the server

    Perforce Gliffy