OrangeHRM Cross-Site Scripting Vulnerability (CNVD-2022-30440)

Orangehrm is a human resource management system HRM from Orangehrm, a US-based company. The system supports personnel information management, leave management, attendance management and recruitment management, etc. Orangehrm version 4.10 has a cross-site scripting vulnerability that can be...

CVE-2022-27109

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

CVE-2022-27107

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideolinkAddress" parameter...

CVE-2022-27108

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

CVE-2022-27110

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint...

Design/Logic Flaw

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint...

Design/Logic Flaw

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

CVE-2022-27109

CVE-2022-27109 affects OrangeHRM 4.10. The issue is a Referer header injection that enables redirect vulnerabilities. The connected Red Hat/CNVD entries reiterate the same description. The documents do not provide details on affected subcomponents, exact exploit steps, scope, or a remediation pat...

CVE-2022-27109

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

CVE-2022-27109

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

CVE-2022-27108

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

CVE-2022-27107

OrangeHRM 4.10 contains a Stored XSS vulnerability in the 3Share Video3 feature under OrangeBuzz, exploitable via the GET/POST parameter createVideo[linkAddress]. The CVE notes this can allow JavaScript execution in the context of an affected user. CVSS metrics report MEDIUM severity (3.1) wi...

CVE-2022-27107

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideolinkAddress" parameter...

Orangehrm 安全漏洞

Orangehrm is a human resource management system HRM from Orangehrm, a US-based company. The system supports personnel information management, leave management, attendance management and recruitment management. orangehrm version 4.10 has a security vulnerability that can be exploited by an attacke...

Orangehrm 跨站脚本漏洞

Orangehrm is a human resource management system HRM from Orangehrm, a US-based company. The system supports personnel information management, leave management, attendance management and recruitment management, etc. Orangehrm version 4.10 has a cross-site scripting vulnerability that can be...

Orangehrm 输入验证错误漏洞

Orangehrm is a human resource management system HRM from Orangehrm, Inc. The system supports personnel information management, leave management, attendance management and recruitment management, etc. Orangehrm version 4.10 has an input validation error vulnerability, which stems from vulnerabilit...

PT-2022-10955 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: zulip/zulip versions prior to 4.10 Description: The issue is related to improper access control in the GitHub repository zulip/zulip. Recommendations: For versions prior to 4.10, update to version 4.10 or later to resolve the issue...

CVE-2022-21706 Multi-use invitations can grant access to other organizations in Zulip

Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation...

GSD-2021-1001903 mlxsw: thermal: Fix out-of-bounds memory accesses

mlxsw: thermal: Fix out-of-bounds memory accesses This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.14 by commit...

UVI-2021-1001826 mlxsw: thermal: Fix out-of-bounds memory accesses

mlxsw: thermal: Fix out-of-bounds memory accesses This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.155 by commit...