Ovaledge

Ovaledge

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.7

CVE-2022-30356

Exploit
  • EPSS 0.05%
  • Veröffentlicht 25.10.2024 17:15:03
  • Zuletzt bearbeitet 31.10.2024 16:31:46

OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.

8.8

CVE-2022-30357

Exploit
  • EPSS 0.09%
  • Veröffentlicht 25.10.2024 17:15:03
  • Zuletzt bearbeitet 31.10.2024 16:43:03

OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required.

8.8

CVE-2022-30358

Exploit
  • EPSS 0.11%
  • Veröffentlicht 25.10.2024 17:15:03
  • Zuletzt bearbeitet 31.10.2024 16:41:38

OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword via the userId and newPsw parameters. Authentication is required.

4.3

CVE-2022-30359

Exploit
  • EPSS 0.12%
  • Veröffentlicht 25.10.2024 17:15:03
  • Zuletzt bearbeitet 31.10.2024 16:37:47

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, ...

6.4

CVE-2022-30360

Exploit
  • EPSS 0.12%
  • Veröffentlicht 25.10.2024 17:15:03
  • Zuletzt bearbeitet 31.10.2024 16:38:26

OvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities via a POST request to /profile/updateProfile via the slackid or phone parameters. Authentication is required.

5.3

CVE-2022-30361

Exploit
  • EPSS 0.11%
  • Veröffentlicht 25.10.2024 17:15:03
  • Zuletzt bearbeitet 31.10.2024 16:34:18

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user ID, status, email address, rol...

7.5

CVE-2022-30354

Exploit
  • EPSS 0.15%
  • Veröffentlicht 25.10.2024 16:15:08
  • Zuletzt bearbeitet 23.04.2025 00:42:41

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The information disclosed is associated with all registered user ID numbers.

9.8

CVE-2022-30355

  • EPSS 0.12%
  • Veröffentlicht 25.10.2024 16:15:08
  • Zuletzt bearbeitet 28.04.2025 17:31:54

OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required.