64 matches found
CVE-2022-39039
aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTPs request to launch Server-Side Request Forgery SSRF attack, to perform arbitrary system command or disrupt service...
CVE-2022-39042
aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access API function to perform arbitrary system command or disrupt service...
CVE-2022-39041
aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database...
Path traversal
aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...
CVE-2022-39041
CVE-2022-39041 affects aEnrich a+HRD. The vulnerability is SQL injection caused by insufficient input validation on a specific API parameter, exploitable by an unauthenticated remote attacker to access, modify, and delete data in the database. The CVSS 3.1 base metrics show high impact with Confi...
CVE-2022-39042
CVE-2022-39042 concerns aEnrich a+HRD, where the login function has improper validation. An unauthenticated, remote attacker can bypass authentication and access API functionality to execute arbitrary system commands or disrupt services. Documented impact includes full authentication bypass and p...
CVE-2022-39042 aEnrich a+HRD - Improper Authentication
aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access API function to perform arbitrary system command or disrupt service...
CVE-2022-28740
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor...
CVE-2022-28741
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion LFI vulnerability that occurs due to missing input validation in v5.x...
Input validation
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion LFI vulnerability that occurs due to missing input validation in v5.x...
Information disclosure
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor...
Improper access control
aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in the application...
CVE-2022-28740
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor...
CVE-2022-28740
The CVE-2022-28740 entry concerns the aEnrich eHRD Learning Management Key Performance Indicator System (version 5+). Affected component/product: aEnrich eHRD LMS KPI System. Impact: exposure of sensitive information to an unauthorized actor. Exploitation details, affected versions beyond 5+, and...
CVE-2022-28742
aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in the application...
CVE-2022-28742
CVE-2022-28742 affects aEnrich eHRD Learning Management Key Performance Indicator System (version 5+). The vulnerability is improper access control: the web application does not validate user sessions on many pages, allowing an unauthenticated attacker to access sensitive functionality. Impact de...
CVE-2022-28741
CVE-2022-28741 affects aEnrich a+HRD 5.x Learning Management Key Performance Indicator System. The issue is a Local File Inclusion (LFI) vulnerability caused by missing input validation in version 5.x. Impact details in the CVE indicate high severity (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H...
CVE-2022-28741
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion LFI vulnerability that occurs due to missing input validation in v5.x...
aEnrich eHRD Learning Management Key Performance Indicator System 5.x 安全漏洞
aEnrich eHRD Learning Management Key Performance Indicator System 5+ is a web-based Learning Management System LMS from aEnrich Corporation in China. A security vulnerability exists in the aEnrich eHRD Learning Management Key Performance Indicator System version 5.x, which originates from exposin...