CVE-2021-35964: Improper Authorization

The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the...

PT-2021-21083

Name of the Vulnerable Software and Affected Versions: Orca HCM digital learning platform affected versions not specified Description: The issue concerns the upload function of the Orca HCM digital learning platform, where a specific parameter does not filter file formats. This allows remote...

PT-2021-21087

Name of the Vulnerable Software and Affected Versions: Orca HCM digital learning platform affected versions not specified Description: The issue concerns the directory page parameter of the Orca HCM digital learning platform, which fails to filter special characters. This allows remote attackers ...

CVE-2021-35966: URL Redirection to Untrusted Site

The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks...

LearningDigital Orca HCM digital learning platform 安全漏洞

LearningDigital Orca HCM digital learning platform is a digital learning platform from China-based LearningDigital. A security vulnerability exists in the Orca HCM digital learning platform, which stems from the platform's use of a weak factory default administrator password, which is hard-coded...

CVE-2021-35967: Improper Limitation of a Pathname to a Restricted Directory

The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in...

PT-2021-21088

Name of the Vulnerable Software and Affected Versions: Orca HCM digital learning platform affected versions not specified Description: The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly, allowing remote attackers to access the...

CVE-2021-35963: Unrestricted Upload of File with Dangerous Type

The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks...

PT-2021-21086

Name of the Vulnerable Software and Affected Versions: Orca HCM digital learning platform affected versions not specified Description: The issue concerns a specific function of the Orca HCM digital learning platform that fails to filter input parameters properly, allowing the URL to be redirected...

CVE-2021-35965: Insufficiently Protected Credentials

The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in...

CVE-2021-35968: Improper Limitation of a Pathname to a Restricted Directory

The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges...