CVE-2024-8585

The CVE-2024-8585 issue is a path-traversal vulnerability in Learning Digital’s Orca HCM file-download function, where a parameter is not properly restricted. This permits a remote attacker with regular privileges to download arbitrary system files. Affected software: Orca HCM from LEARNING DIGIT...

CVE-2024-8585 LEARNING DIGITAL Orca HCM - Arbitrary File Download

Orca HCM from LEARNING DIGITA does not properly restrict a specific parameter of the file download functionality, allowing a remote attacker with regular privileges to download arbitrary system files...

CVE-2024-8584 LEARNING DIGITAL Orca HCM - Missing Authentication

Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in...

CVE-2024-8584

CVE-2024-8584 affects Orca HCM by LEARNING DIGITAL and is described as a Missing Authentication vulnerability that allows an unauthenticated remote attacker to create an administrator account and log in. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8) indicates a critical imp...

CVE-2024-8584 LEARNING DIGITAL Orca HCM - Missing Authentication

Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in...

CVE-2024-8584: Missing Authentication for Critical Function

Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in...

Learning Digital Orca HCM 访问控制错误漏洞

Learning Digital Orca HCM is a digital learning platform from China-based Learning Digital. An access control error vulnerability exists in Learning Digital Orca HCM prior to version 11.0, which arises from improperly restricting access to a specific feature, which could allow an unauthenticated,...

LearningDigital Orca HCM 路径遍历漏洞

LearningDigital Orca HCM is a digital learning platform from China-based LearningDigital. A path traversal vulnerability exists in LearningDigital Orca HCM versions prior to 11.0, which arises from improperly restricting certain parameters of the file download function, allowing a remote attacker...

CVE-2024-8585: Improper Limitation of a Pathname to a Restricted Directory

Orca HCM from LEARNING DIGITA does not properly restrict a specific parameter of the file download functionality, allowing a remote attacker with regular privileges to download arbitrary system files...

PT-2024-39121 · Learning Digital · Orca Hcm

Name of the Vulnerable Software and Affected Versions: Orca HCM from LEARNING DIGITA versions up to 10.x Description: The issue is related to the file download functionality, where a specific parameter is not properly restricted. This allows a remote attacker with regular privileges to download...

RHEL 6 : orca (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - orca: Arbitrary code execution due to insecure CWD Python module load CVE-2013-4245 Note that Nessus has not tested...

RHEL 5 : orca (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - orca: Arbitrary code execution due to insecure CWD Python module load CVE-2013-4245 Note that Nessus has not tested...

AWS, Google, and Azure CLI Tools Could Leak Credentials in Build Logs

New cybersecurity research has found that command-line interface CLI tools from Amazon Web Services AWS and Google Cloud can expose sensitive credentials in build logs, posing significant risks to organizations. The vulnerability has been codenamed LeakyCLI by cloud security firm Orca. "Some...

MAL-2024-1270 Malicious code in snap-orca (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf9eff937bcee16db9ca91202bb07969de9b49b32196de1bb49ade4bcbe83d31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in snap-orca (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf9eff937bcee16db9ca91202bb07969de9b49b32196de1bb49ade4bcbe83d31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

orca-international.com Cross Site Scripting vulnerability OBB-3854506

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Google Kubernetes Misconfig Lets Any Gmail Account Control Your Clusters

Cybersecurity researchers have discovered a loophole impacting Google Kubernetes Engine GKE that could be potentially exploited by threat actors with a Google account to take control of a Kubernetes cluster. The critical shortcoming has been codenamed Sys:All by cloud security firm Orca. As many ...

Wrong invocation of Whirpools's updateFeesAndRewards will cause it to always revert

Lines of code Vulnerability details Impact Deposits will be unwithdrawable from the lockbox Proof of Concept If the entire liquidity of a position has been removed, the withdraw function calls the updateFeesAndRewards function on the Orca pool before attempting to close the position. function...

orca-md.com Improper Access Control vulnerability OBB-3806544

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

orca.science.oregonstate.edu Cross Site Scripting vulnerability OBB-3787652

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...