7 matches found
CVE-2017-7313
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...
CVE-2017-7314: Improper Authentication
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...
CVE-2017-7312: Improper Privilege Management
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data including usernames and passwords...
PT-2017-17656
Name of the Vulnerable Software and Affected Versions Personify360 e-Business versions 7.5.2 through 7.6.1 Description An issue in Personify360 e-Business allows unauthorized access to vendor account data. By visiting the "/TabId/275" API endpoint, an attacker can add a new vendor account or read...
PT-2017-17658
Name of the Vulnerable Software and Affected Versions Personify360 e-Business versions 7.5.2 through 7.6.1 Description An issue in Personify360 e-Business allows access to a list of database tables and their columns when creating a new role and visiting the "/TabId/275" API endpoint...
CVE-2017-7313: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...
PT-2017-17657
Name of the Vulnerable Software and Affected Versions Personify360 e-Business versions 7.5.2 through 7.6.1 Description An issue in the software allows unauthorized access to customer information. By visiting the "/TabId/275" API endpoint, an attacker can read customer names, master Customer Ids,...