CVE-2021-35963: falha crítica em Learningdigital.com, Inc. Orca HCM
Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 2.4%
The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Learningdigital.com, Inc. · Orca HCMCVEs relacionadas — Learningdigital.com, Inc. Orca HCM
No mesmo produto, das mais perigosas para as menos.
CVE-2021-35965CRITICALLearningdigital.com, Inc. Orca HCM - Hard-code passwordEPSS 2.4%CVE-2021-35967MEDIUMLearningdigital.com, Inc. Orca HCM - Path Traversal-1EPSS 1.3%CVE-2021-35964HIGHLearningdigital.com, Inc. Orca HCM - Broken AuthenticationEPSS 1.1%CVE-2021-35968MEDIUMLearningdigital.com, Inc. Orca HCM - Path Traversal-2EPSS 1.0%CVE-2021-35966MEDIUMLearningdigital.com, Inc. Orca HCM - URL Redirection to Untrusted Site ('Open Redirect')EPSS 0.8%