OP
Product
Opencast
20
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 1High 7Medium 12Low 0
Watch
Add Opencast to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-5206 | 10.0 | Jan 30 | In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me… Affected: before 7.6; 8.0 |
| CVE-2020-5222 | 8.8 | Jan 30 | Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key Affected: before 7.6; 8.0 |
| CVE-2020-5229 | 8.1 | Jan 30 | Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm Affected: before 8.1 |
| CVE-2021-43821 | 7.7 | Dec 14 | Opencast is an Open Source Lecture Capture & Video Management for Education Affected: before 10.6 |
| CVE-2024-52797 | 7.5 | Nov 21 | Opencast is free and open source software for automated video capture and distribution Affected: 11.4 before 13.10; 14.0 before 14.3; 15.0 before 16.7 |
| CVE-2018-16153 | 7.5 | Dec 12 | An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6 Affected: 4.0 before 10.6 |
| CVE-2020-5230 | 7.5 | Jan 30 | Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used Affected: before 7.6; 8.0 |
| CVE-2020-5228 | 7.5 | Jan 30 | Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH Affected: before 7.6; 8.0 |
| CVE-2025-54380 | 6.5 | Jul 26 | Opencast still publishes global system account credentials Affected: before 17.6 |
| CVE-2021-43807 | 6.5 | Dec 14 | Opencast is an Open Source Lecture Capture & Video Management for Education Affected: before 9.10 |
| CVE-2021-32623 | 6.5 | Jun 16 | Opencast is a free and open source solution for automated video capture and distribution Affected: before 9.6 |
| CVE-2020-5231 | 6.5 | Jan 30 | In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN Affected: before 7.6; 8.0 |
| CVE-2017-1000221 | 6.5 | Nov 17 | In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so… Affected: through 2.2.3 |
| CVE-2022-41965 | 6.1 | Nov 28 | Opencast is a free, open-source platform to support the management of educational audio and video content Affected: before 12.5 |
| CVE-2025-61788 | 5.4 | Oct 8 | Opencast Paella Player 7 vulnerable to Cross-Site-Scripting Affected: before 17.8; 18.0 before 18.2 |
| CVE-2022-29237 | 5.4 | May 24 | Opencast is a free and open source solution for automated video capture and distribution at scale Affected: before 10.14; 11.0 before 11.7 |
| CVE-2021-21318 | 5.4 | Feb 18 | Opencast is a free, open-source platform to support the management of educational audio and video content Affected: before 9.2 |
| CVE-2025-55202 | 5.3 | Aug 29 | Opencast has a partial path traversal vulnerability in UI config Affected: before 17.7; 18.0 |
| CVE-2020-26234 | 4.8 | Dec 8 | Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests Affected: before 7.9; 8.0 before 8.9 |
| CVE-2025-61906 | 4.3 | Oct 8 | Opencast's editor accidentally publishes videos/overwrites publications #1626 Affected: before 17.8; 18.0 before 18.2 |
Showing 20