CVE-2010-0123

The database backup implementation in Employee Timeclock Software 0.99 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a "semi-predictable file name."...

CVE-2010-0122

Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to a auth.php or b loginaction.php...

CVE-2010-0122

CVE-2010-0122 affects Employee Timeclock Software 0.99, where input passed to username and password parameters in auth.php and login_action.php is not properly sanitized, allowing remote SQL injection. This leads to arbitrary SQL execution and data manipulation as described in Secunia/NT referenc...

CVE-2010-0123

The CVE-2010-0123 issue affects Employee Timeclock Software 0.99, where the backup database is stored under the web root with insufficient access control. This enables remote attackers to download the database by directly requesting a semi-predictable file name. The vulnerability stems from insec...

CVE-2010-0124

Employee Timeclock Software 0.99 places the database password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...

Secunia Research: Employee Timeclock Software Backup Information Disclosure

====================================================================== Secunia Research 10/03/2010 - Employee Timeclock Software Backup Information Disclosure - ====================================================================== Table of Contents Affected...

Secunia Research: Employee Timeclock Software "mysqldump" Password Disclosure

====================================================================== Secunia Research 10/03/2010 - Employee Timeclock Software "mysqldump" Password Disclosure - ====================================================================== Table of Contents Affected...

Secunia Research: Employee Timeclock Software SQL Injection Vulnerabilities

====================================================================== Secunia Research 10/03/2010 - Employee Timeclock Software SQL Injection Vulnerabilities - ====================================================================== Table of Contents Affected...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in adduser.php in Employee Timeclock Software 0.99 allows remote attackers to hijack the authentication of an administrator for requests that create new administrative users. NOTE: some of these details are obtained from third party information...

CVE-2010-0707

Cross-site request forgery CSRF vulnerability in adduser.php in Employee Timeclock Software 0.99 allows remote attackers to hijack the authentication of an administrator for requests that create new administrative users. NOTE: some of these details are obtained from third party information...

CVE-2010-0707

Cross-site request forgery CSRF vulnerability in adduser.php in Employee Timeclock Software 0.99 allows remote attackers to hijack the authentication of an administrator for requests that create new administrative users. NOTE: some of these details are obtained from third party information...

CVE-2010-0707

CVE-2010-0707: CSRF in Employee Timeclock Software 0.99 (add_user.php) allows remote attackers to hijack an administrator’s session and create new administrative users. Root cause is CSRF vulnerability on admin-account creation requests; impact is unauthorized admin account creation as described....

27K Employee Records Hacked at Ceridian

A hacker attack at payroll processing firm Ceridian Corp. has potentially revealed the names, Social Security numbers, and, in some cases, the birth dates and bank accounts of 27,000 employees working at 1,900 companies nationwide. Read the full article. StarTribune...

80K Records' Breached in Iowa Gaming Hack

Around 80,000 Iowa employee names, birth dates and social security numbers have been exposed after an Iowa Gaming Commission server was hacked. Read the full article. Secure Computing...

CAPTCHA Option Should Exist for The Password Reset Form

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-20150. panel The password reset prompt allows an individual to reset any user's password. My company uses a standard employee id to use for t...

Prisoner Hacks Prison Employee Info in Jail

A former Massachusetts prison inmate has been given an 18-month prison sentence for hacking prison computers while he was incarcerated. Read the full article. Computerworld...

Billwerx RC 3.1 - Multiple Vulnerabilities

Billwerx RC 3.1 - Multiple Vulnerabilities Billwerx RC v3.1 Multiple Vulnerabilities Found By: mrme Download: http://www.billwerx.com/download.php Tested On: Windows Vista Note: For educational purposes only XSS POC: A regular employee can embed javascript code that could be executed within the...

Ex-United Way IT Employee Sentenced to 18 Months

Former United Way employee based in Miami, Luis Robert Altamirano, was sentenced to 18 months in jail and fined $50,000 for accessing his former employers’ network and deleting “numerous files from UWMD’s servers” and disabling “UWMD’s telephone voice mail system and prevented UWMD employees from...

MassMutual Employee DB Hacked

MassMutual officials this week confirmed that one of its employee databases was accessed by an unauthorized person or persons, exposing an unknown number of employees’ personal data for a yet-to-be-determined amount of time. The Springfield, Mass.-based insurer said the compromised database was...

How to Protect Your Resume From Identity Theft

“Job candidates are willing in this market to give any information they can that would help them get a job,” said Ellen B. Vance, an HR consultant and auditor who advises companies on how to safeguard applicant and employee information. The instinct is natural, but it can leave you vulnerable to...