Orangescrum Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/orangescrum/ Wed, 22 Feb 2023 14:02:15 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png Orangescrum Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/orangescrum/ 32 32 CVE-2023-0624 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0624/ Wed, 22 Feb 2023 14:02:15 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0624 OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

The post CVE-2023-0624 appeared first on CVE Vulnerability.

]]> OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

The post CVE-2023-0624 appeared first on CVE Vulnerability.

]]> CVE-2023-0454 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0454/ Wed, 22 Feb 2023 14:02:14 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0454 OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path.

The post CVE-2023-0454 appeared first on CVE Vulnerability.

]]> OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path.

The post CVE-2023-0454 appeared first on CVE Vulnerability.

]]> CVE-2023-0164 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0164/ Wed, 22 Feb 2023 14:02:12 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0164 OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.

The post CVE-2023-0164 appeared first on CVE Vulnerability.

]]> OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.

The post CVE-2023-0164 appeared first on CVE Vulnerability.

]]>