CVE-2022-1543

Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server...

CVE-2022-1543

Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server...

Design/Logic Flaw

Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server...

CVE-2022-1543

CVE-2022-1543 affects erudika/scoold prior to 1.49.4. The root cause is improper handling of the Length parameter in large text inputs, which can cause a momentary outage and potential memory corruption on the server. CVSS metrics indicate high/critical impact (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H...

CVE-2022-1543 Improper handling of Length parameter in erudika/scoold

Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server...

CVE-2022-1543 Improper handling of Length parameter in erudika/scoold

Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server...

Erudika Scoold 安全漏洞

Erudika Scoold is an open source question and answer/knowledge base platform written in Java by the Bulgarian company Erudika. A security vulnerability exists in Scoold prior to version 1.49.4, which stems from improper handling of the Length parameter. When the text size was large enough, the...

CVE-2021-46372

Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...

CVE-2021-46372

Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...

CVE-2021-46372

Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...

Design/Logic Flaw

Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...

CVE-2021-46372

CVE-2021-46372 affects Scoold 1.47.2 (Java-based Q&A/KBA). The markdown editor is vulnerable to an XSS attack when uppercase letters are used in a Q&A. NVD/OSV entries describe a Medium severity (CVSS 3.1 base score 5.4) with network attack vector and user interaction required. The provided docum...

CVE-2021-46372

Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...

Erudika Scoold跨站脚本漏洞

Erudika Scoold is an open source Q&A/knowledge base platform written in Java by Erudika Bulgaria. A security vulnerability exists in Scoold 1.47.2, which stems from the markdown editor being susceptible to an XSS attack if capitalization is used when writing a Q&A...

Open Redirect in erudika/scoold

Description Hi erudika scoold team, there is an Open redirect in your source code at question url Proof of Concept 1. Go to this link https://pro.scoold.com/questions/space?returnto=https://google.com 2. Observe that you are redirected to google.com Impact This vulnerability is capable of Open...

Cross-Site Request Forgery (CSRF) in erudika/scoold

Description Hi there, I would like to report a CSRF vulnerability in erudika/scoold. This allows an attacker to change the current user question space or add them to default space against their will. Proof of Concept 1. Access scoold demo at https://pro.scoold.com/ and log in 2. Access this link...

Server-Side Request Forgery (SSRF) in erudika/scoold

✍️ Description Affected URL is vulnerable to Server-Side Request Forgery SSRF. An attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address. 🕵️‍♂️ Proof of Concept @GetMapping"", "/id/" public String get@PathVariablerequired = false...

Open Redirect in erudika/scoold

✍️ Description There is an open redirect vulnerability in the following URL: https://live.scoold.com/signin?returnto=https://google.com 🕵️‍♂️ Proof of Concept Step to reproduce 1. open above URL 2. login in the applicaiton 3. you redirect to google.com 💥 Impact That causes a redirection to an...

Server-Side Request Forgery (SSRF) in erudika/scoold

✍️ Description Possible SSRF in scoold in user profile picture from URL 🕵️‍♂️ Proof of Concept Steps to reproduce: 1. Create an account and click on the image. 2. Now open the local server or enter any IP:port ex: http://127.0.0.1:8082 3. Now enter the URL and then view the image, you will see get...

Session Fixation in erudika/scoold

✍️ Description Session Fixation vulnerability found in scoold in which it doesn't expire the sessions after password update. 🕵️‍♂️ Proof of Concept Steps to reproduce: 1. Open the same account in the normal and private tab. 2. Change the password from anyone tab let's say private and then refresh...