Electronic Docketing System (Eds)
Approved changes feed: RSS · Atom
cpe:2.3:a:civilian_board_of_contract_appeals:electronic_docketing_system_(eds):*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Civilian Board Of Contract Appeals (34076d32-e652-56a7-b543-148d240ed788) |
|---|---|
| Product | Electronic Docketing System (Eds) (ba74c79d-13c2-5212-9259-d6a3d154859a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54106 |
vulnerable | 2026-07-29 01:00:27.437845 |
U.S. GAO EPDS and CBCA EDS network access control bypass
MEDIUM (4.7)
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.
Published: 2026-06-18T16:13:47.351Z
Updated: 2026-06-24T19:52:10.880Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54105 |
vulnerable | 2026-07-29 01:00:27.437493 |
U.S. GAO EPDS and CBCA EDS user information disclosure
MEDIUM (5.3)
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.
Published: 2026-06-18T16:13:24.123Z
Updated: 2026-06-24T19:54:05.421Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54104 |
vulnerable | 2026-07-29 01:00:27.437309 |
U.S. GAO EPDS and CBCA EDS client-based privilege escalation
HIGH (8.8)
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.
Published: 2026-06-18T16:12:58.699Z
Updated: 2026-06-22T12:32:43.637Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54103 |
vulnerable | 2026-07-29 01:00:27.436837 |
U.S. GAO EPDS and CBCA EDS unauthenticated password change
CRITICAL (9.8)
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.
Published: 2026-06-18T16:12:35.433Z
Updated: 2026-06-22T12:32:52.614Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.