Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
apereo opencast 8.0 vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv2
CVE-2020-5222
Opencast prior to 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using th...
Apereo Opencast
Apereo Opencast 8.0
5
CVSSv2
CVE-2020-5228
Opencast prior to 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly han...
Apereo Opencast
Apereo Opencast 8.0
6.4
CVSSv2
CVE-2020-5206
In Opencast prior to 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attack...
Apereo Opencast
Apereo Opencast 8.0
4
CVSSv2
CVE-2020-5231
In Opencast prior to 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (ex...
Apereo Opencast
Apereo Opencast 8.0
5
CVSSv2
CVE-2020-5230
Opencast prior to 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape...
Apereo Opencast
Apereo Opencast 8.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3581
reflected XSS
CVE-2024-26925
CVE-2024-27956
LFI
CVE-2024-3607
CVE-2024-3107
CVE-2024-3295
SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started