Advisories · Technology
OpenOLAT.
Every CVE that names OpenOLAT among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution
- OpenOLAT
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow
- OpenOLAT
- Authentication bypass
- Weak cryptography or TLS
- CVSS 4.6 Medium
XML external entity (XXE) injection in OpenOLAT
- OpenOLAT
- XML external entities (XXE)
- CVSS 8.1 High
Path Traversal in some REST methods leading to file upload to arbitrary places
- OpenOLAT
- Path traversal
- CVSS 7.7 High
Path Traversal in Folder Component Leading to Local File Inclusion
- OpenOLAT
- Path traversal
- CVSS 8.8 High
Unsafe Deserialization of User Data Using XStream
- OpenOLAT
- Other injection
- CVSS 8.1 High
Path Traversal in Archive Handling Leading to Code Execution
- OpenOLAT
- Path traversal