PT-2021-23420

Name of the Vulnerable Software and Affected Versions Verint Workforce Optimization WFO version 15.2.5.1033 Description The issue allows HTML injection via the "/wfo/control/signin" API endpoint, specifically through the username parameter. Recommendations For version 15.2.5.1033, consider...

CVE-2021-41825: Improper Neutralization of Input During Web Page Generation

Verint Workforce Optimization WFO 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter...

CVE-2019-12784

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

CVE-2019-12783: URL Redirection to Untrusted Site

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successful login. In conjunction with CVE-2019-12784, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site,...

CVE-2019-12784: Cross-Site Request Forgery (CSRF)

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

PT-2020-9340

Name of the Vulnerable Software and Affected Versions: Verint Impact 360 version 15.1 Description: An issue was discovered that allows attackers to potentially compromise valid credentials. At the /wfo/control/signin API endpoint, the rd parameter can accept a URL, to which users will be redirect...

PT-2020-9341

Name of the Vulnerable Software and Affected Versions: Verint Impact 360 version 15.1 Description: An issue was discovered where the login form at the /wfo/control/signin API endpoint can accept submissions from external websites. This can be exploited by attackers to crowdsource brute-force logi...