EUVD-2017-9132

Malware in sbrugna...

Server side request forgery (ssrf)

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17990

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

CVE-2017-17995

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

PT-2017-15147

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

CVE-2017-17995: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

PT-2017-15151

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the Last Name...

CVE-2017-17991: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

PT-2017-15149

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

PT-2017-15148

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue allows for Arbitrary File Download via directory traversal sequences. This is achieved by manipulating the form file name parameter in a download...

PT-2017-15150

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the criteria parameter in a specific request...

PT-2017-15146

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue is related to a CSRF flaw in the Biometric Shift Employee Management System. Specifically, it affects the edit holiday action in index.php...

PT-2017-15145

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to the lack of proper input validation in the...

CVE-2017-17993: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17989: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...

CVE-2017-17992: Improper Limitation of a Pathname to a Restricted Directory

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...

CVE-2017-17990: Cross-Site Request Forgery (CSRF)

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

CVE-2017-17994: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

CVE-2017-17876: Undefined Security Weakness

Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter...

Biometric Shift Employee Management System 3.0 - Local File Disclosure

Biometric Shift Employee Management System 3.0 - Local File Disclosure Exploit Title: Biometric Shift Employee Management System 3.0 - Local File Download Dork: N/A Date: 24.12.2017 Vendor Homepage: https://www.shiftsystems.net/ Software Link:...