Ovaledge

ovaledge

8 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (8)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-30361 1Ovaledge 1Ovaledge Oct 31, 2024 Oct 25, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user...Show more OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user ID, status, email address, role(s), user type, license type, and personal details such as first name, last name, gender, and user preferences.Show less
CVE-2022-30360 1Ovaledge 1Ovaledge Oct 31, 2024 Oct 25, 2024 N/A· v4 6.4 MEDIUM· v3 N/A· v2 OvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities via a POST request to /profile/updateProfile via the slackid or phone parameters. Authentication is required.
CVE-2022-30359 1Ovaledge 1Ovaledge Oct 31, 2024 Oct 25, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered user...Show more OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, role(s), user type, license type, and personal details such as first name, last name, gender, and user preferences.Show less
CVE-2022-30358 1Ovaledge 1Ovaledge Oct 31, 2024 Oct 25, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword via the userId and newPsw parameters. Authentication is required.
CVE-2022-30357 1Ovaledge 1Ovaledge Oct 31, 2024 Oct 25, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required.
CVE-2022-30356 1Ovaledge 1Ovaledge Oct 31, 2024 Oct 25, 2024 N/A· v4 4.7 MEDIUM· v3 N/A· v2 OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.
CVE-2022-30355 1Ovaledge 1Ovaledge Apr 28, 2025 Oct 25, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required.
CVE-2022-30354 1Ovaledge 1Ovaledge Apr 23, 2025 Oct 25, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The information disclosed is associated with all registered user...Show more OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The information disclosed is associated with all registered user ID numbers.Show less