3258 matches found
Who's Experimenting with AI Tools in Your Organization?
With the record-setting growth of consumer-focused AI productivity tools like ChatGPT, artificial intelligence—formerly the realm of data science and engineering teams—has become a resource available to every employee. From a productivity perspective, that's fantastic. Unfortunately for IT and...
CVE-2023-45391
A stored cross-site scripting XSS vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter...
CVE-2023-45391
A stored cross-site scripting XSS vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter...
PT-2023-29544
Name of the Vulnerable Software and Affected Versions Granding UTime Master version 9.0.7-Build:Apr 4,2023 Description A stored cross-site scripting issue in the Create A New Employee function allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected...
CVE-2023-45391: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter...
PrestaShop allows employee without any access rights to list all installed modules
Impact In BO, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights Patches Fixed on 8.1.2 Workarounds References...
GHSA-GVRG-62JP-RF7J PrestaShop allows employee without any access rights to list all installed modules
Impact In BO, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights Patches Fixed on 8.1.2 Workarounds References...
WordPress Staff / Employee Business Directory for Active Directory Plugin <= 1.2.3 is vulnerable to Broken Access Control
Software Staff / Employee Business Directory for Active Directory Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4505 Patch priority Low CVSS severity Low 2.2 Developer Claim ownership PSID 98e206a92bda...
CVE-2023-4505: Missing Authentication for Critical Function
The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative...
PT-2023-29369
Name of the Vulnerable Software and Affected Versions The Staff / Employee Business Directory for Active Directory plugin for WordPress versions up to, and including, 1.2.3 The Active Directory Integration / LDAP Integration plugin for WordPress versions up to, and including, 4.1.10 Description T...
Avoid These 5 IT Offboarding Pitfalls
Employee offboarding is no one's favorite task, yet it is a critical IT process that needs to be executed diligently and efficiently. That's easier said than done, especially considering that IT organizations have less visibility and control over employees' IT use than ever. Today, employees can...
FBI Hacker Dropped Stolen Airbus Data on 9/11
In December 2022, KrebsOnSecurity broke the news that a cybercriminal using the handle "USDoD" had infiltrated the FBIs vetted information sharing network InfraGard, and was selling the contact information for all 80,000 members. The FBI responded by reverifying InfraGard members and by seizing t...
WordPress Staff / Employee Business Directory for Active Directory Plugin < 1.2.3 is vulnerable to Broken Access Control
Software Staff / Employee Business Directory for Active Directory Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-4757 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 41d386a4513c...
Staff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entries
Description The plugin does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin. Add a...
CVE-2023-31944
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the empid parameter at employeeedit.php...
CVE-2023-31944
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the empid parameter at employeeedit.php...
CVE-2023-31938
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the empid parameter at employeedetail.php...
CVE-2023-31941
File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP file to the employeeinsert.php...