Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
apereo opencast 8.0 vulnerabilities and exploits
(subscribe to this query)
10
CVSSv3
CVE-2020-5206
In Opencast prior to 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attack...
Apereo Opencast 8.0
Apereo Opencast
8.8
CVSSv3
CVE-2020-5222
Opencast prior to 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using th...
Apereo Opencast 8.0
Apereo Opencast
7.5
CVSSv3
CVE-2020-5230
Opencast prior to 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape...
Apereo Opencast 8.0
Apereo Opencast
7.5
CVSSv3
CVE-2020-5228
Opencast prior to 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly han...
Apereo Opencast 8.0
Apereo Opencast
6.5
CVSSv3
CVE-2020-5231
In Opencast prior to 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (ex...
Apereo Opencast 8.0
Apereo Opencast
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-37316
firmware
CVE-2024-30078
CVE-2024-5995
remote code execution
logic flaw
CVE-2024-20693
CVE-2024-37315
CVE-2024-5464
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started