47 matches found
CVE-2026-54676: Missing Authorization
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...
Scoold security vulnerabilities
Scoold is a team-based Q&A and knowledge-sharing platform developed by Erudika. Versions of Scoold prior to 1.66.2 contained security vulnerabilities. These vulnerabilities were due to authorization flaws, which could allow low-privilege users to override the permissions of other users...
EUVD-2022-24839
Malicious code in bioql PyPI...
EUVD-2022-2323
Malicious code in bioql PyPI...
EUVD-2022-4776
Malicious code in bioql PyPI...
Paragraph: Log Information Leakage Vulnerability
para is a multi-tenant backend server open-sourced by Erudika for rapidly building web and mobile applications. A log information disclosure vulnerability exists in versions prior to para 1.50.8, which stems from explicit logging of access tokens in the logs, which could lead to token disclosure...
Paragraph: Log Information Leakage Vulnerability
para is a multi-tenant backend server open-sourced by Erudika for rapidly building web and mobile applications. A log information disclosure vulnerability exists in versions prior to para 1.50.8, which stems from the failure to desensitize access keys and secret keys in logs, which could lead to...
CVE-2022-1848
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
CVE-2022-1782
Cross-site Scripting XSS - Generic in GitHub repository erudika/para prior to v1.45.11...
com.erudika:para-jar (>=1.31.1, <=1.31.2), com.erudika:para-server (>=1.31.1, <=1.31.2) +330 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (6.5.1)
com.nimbusds:nimbus-jose-jwt MAVEN version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.erudika:para-jar =1.31.1, =1.31.1, =1.31.1, =2.7.7.3, =2.7.7.3, =1.5.9, =1.5.9, =1.9.3, =1.5.9,...
WS-2022-0205
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in erudika/para...
CVE-2022-1848
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
CVE-2022-1848
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
Code injection
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
CVE-2022-1848 Business Logic Errors in erudika/para
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
CVE-2022-1848 Business Logic Errors in erudika/para
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
CVE-2022-1848
CVE-2022-1848 affects the Erudika Para project prior to version 1.45.11. Multiple connected sources describe a business logic error, including a race condition in com.erudika:para-core (validateObject) that can allow a user to abuse account/app-related logic. This is documented across sources (Gi...
CVE-2022-1848
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
Erudika Para security vulnerabilities
Erudika Para is a command line interface from Erudika Bulgaria. A security vulnerability exists in Erudika Para prior to version 1.45.11 that stems from a business logic error...