CVE-2024-4536

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component https://github.com/eclipse-edc/Connector , an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security...

CVE-2024-4536 Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component https://github.com/eclipse-edc/Connector , an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security...

CVE-2024-4536 Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component https://github.com/eclipse-edc/Connector , an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security...

CVE-2024-4536

The CVE-2024-4536 issue affects Eclipse Dataspace Components (EDC) Connector versions 0.2.1–0.6.2. A security flaw in the OAuth2-protected data sink feature allows the consumer-provided clientSecretKey to be resolved in the provider vault instead of the consumer vault, causing the secret to be ex...

edc-protection.com Improper Access Control vulnerability OBB-3827961

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-24831

OpenClinica (EDC/CDM platform) has a SQL injection vulnerability in versions prior to 3.16.1 caused by building SQL via string concatenation instead of prepared statements. Exploitation можно leads to partial confidentiality, integrity, and availability impact as per CVSS data. The issue has been...

CVE-2022-24830

OpenClinica is an open source software for Electronic Data Capture EDC and Clinical Data Management CDM. OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote code execution. There are no known...

CVE-2022-24830

OpenClinica is affected prior to version 3.16 by a path traversal vulnerability across multiple endpoints, enabling arbitrary file read/write and potential remote code execution. Root cause is path traversal in affected endpoints. Impact is high, with potential for partial confidentiality/integri...