Show filters
6 Total Results
Displaying 1-6 of 6
Sort by:
Attacker Value
Unknown

CVE-2022-30361

Disclosure Date: October 25, 2024 (last updated November 01, 2024)
OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user ID, status, email address, role(s), user type, license type, and personal details such as first name, last name, gender, and user preferences.
Attacker Value
Unknown

CVE-2022-30360

Disclosure Date: October 25, 2024 (last updated November 01, 2024)
OvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities via a POST request to /profile/updateProfile via the slackid or phone parameters. Authentication is required.
Attacker Value
Unknown

CVE-2022-30359

Disclosure Date: October 25, 2024 (last updated November 01, 2024)
OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, role(s), user type, license type, and personal details such as first name, last name, gender, and user preferences.
Attacker Value
Unknown

CVE-2022-30358

Disclosure Date: October 25, 2024 (last updated November 01, 2024)
OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword via the userId and newPsw parameters. Authentication is required.
Attacker Value
Unknown

CVE-2022-30357

Disclosure Date: October 25, 2024 (last updated November 01, 2024)
OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required.
Attacker Value
Unknown

CVE-2022-30356

Disclosure Date: October 25, 2024 (last updated November 01, 2024)
OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.