Apereo Opencast

Authentication Bypass For Endpoints With Anonymous Access in OpenCast

Files Accessible to External Parties in Opencast

Hard-Coded Key Used For Remember-me Token in OpenCast

Opencast vulnerable to billion laughs attack (XML bomb)

Opencast stores passwords using outdated MD5 hash algorithm

Opencast uses unsafe identifiers

Opencast allows unauthorized public access via OAI-PMH

HTTP Method Spoofing in Opencast

Searching Opencast may cause a denial of service

An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role ROLE_USER will have access to recordings published only for ROLE_USER_X.

Opencast users with ROLE_COURSE_ADMIN can create new users

Opencast still publishes global system account credentials

Opencast Authenticated OpenRedirect Vulnerability

Removing access may not effect published series

Limited Authentication Bypass for Media Files in Opencast

Opencast Paella Player 7 vulnerable to Cross-Site-Scripting

Opencast has a partial path traversal vulnerability in UI config

Disabled Hostname Verification in OpenCast

Opencast's editor accidentally publishes videos/overwrites publications #1626