PT-2024-39121 · Learning Digital · Orca Hcm

Name of the Vulnerable Software and Affected Versions: Orca HCM from LEARNING DIGITA versions up to 10.x Description: The issue is related to the file download functionality, where a specific parameter is not properly restricted. This allows a remote attacker with regular privileges to download...

CVE-2024-21122

Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft component: Text Catalog. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HC...

CVE-2024-21122

Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft component: Text Catalog. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HC...

CVE-2024-21122

The CVE-2024-21122 entry affects Oracle PeopleSoft 9.2, specifically the Text Catalog in PeopleSoft Enterprise HCM Shared Components. The Root Cause is insufficient input validation in the Text Catalog component, enabling a low-privileged attacker with network access via HTTP to compromise the co...

PT-2024-7459 · Oracle · Peoplesoft Enterprise Hcm Human Resources

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise HCM Human Resources version 9.2 Description: The issue exists due to insufficient input validation in the Human Resources component of PeopleSoft Enterprise HCM Human Resources. This allows a remote attacker to gain...

PT-2024-4994 · Oracle · Peoplesoft Enterprise Hcm Shared Components

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise HCM Shared Components version 9.2 Description: The issue is related to insufficient input validation in the Text Catalog component of PeopleSoft Enterprise HCM Shared Components. This easily exploitable vulnerability...

Use After Free

github.com/envoyproxy/envoy is vulnerable to a use-after-free. The vulnerability is due to QUICHE continuing to push request headers after the StopReading method is called on the stream, which can lead to accessing a destroyed HCM ActiveStream object. This allows attackers to disrupt service by...

Use After Free

Envoy is vulnerable to a Use-After-Free vulnerability. The vulnerability is due to improper handling in HttpConnectionManager HCM with EnvoyQuicServerStream, where an attacker can crash Envoy by sending a request without FIN, followed by a RESETSTREAM frame, and then closing the connection after...

CVE-2024-32974

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in EnvoyQuicServerStream::OnInitialHeadersComplete with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after StopReading being called on the stream. As after StopReadin...

CVE-2024-32974 Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in EnvoyQuicServerStream::OnInitialHeadersComplete with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after StopReading being called on the stream. As after StopReadin...

CVE-2024-34362 Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in HttpConnectionManager HCM with EnvoyQuicServerStream that can crash Envoy. An attacker can exploit this vulnerability by sending a request without FIN, then a RESETSTREAM frame, and then after receiving the...

PT-2024-41449 · Ооо "Вебсофт Девелопмент" · Websoft Hcm

Уязвимость программного обеспечения автоматизации HR-процессов Websoft HCM связана с непринятием мер по нейтрализации специальных элементов, используемых в команде ОС. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнять произвольные команды путём вызова метода из...

PT-2024-41445 · Ооо "Вебсофт Девелопмент" · Websoft Hcm

Уязвимость программного обеспечения автоматизации HR-процессов Websoft HCM связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, провести атаку межсайтового скриптинга XSS путём внедрения специально сформированного...

Vulnerabilities fixed in Oracle PeopleSoft

Oracle has fixed vulnerabilities in several PeopleSoft products. A malicious party can exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Cross-Site Scripting XSS. Data manipulation. Remote code execution User Rights Access to sensitive data...

CVE-2024-21063

Vulnerability in the PeopleSoft Enterprise HCM Benefits Administration product of Oracle PeopleSoft component: Benefits Administration. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft...

CVE-2024-21063

The CPT/PT Security report PT-2024-3531 documents a vulnerability in PeopleSoft Enterprise HCM Benefits Administration (version 9.2) due to insufficient input validation in the Benefits Administration component.An attacker with logon access and low privileges can exploit this (with user interacti...

The vulnerability of Websoft HCM’s automation software for HR processes lies in the lack of measures taken to protect the website structure, allowing attackers to execute cross-site scripting attacks.

The vulnerability of Websoft HCM’s automation software for HR processes is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows attackers to execute cross-site scripting XSS attacks remotely...

SAP HCM Travel Management Cross-Site Scripting Vulnerability

SAP HCM Travel Management is a travel management module from SAP. A cross-site scripting vulnerability exists in SAP HCM Travel Management that stems from insufficiently encoded user input and can be exploited by an attacker to cause a cross-site scripting XSS attack...

The vulnerability of Websoft HCM’s automation solutions for HR processes stems from improper segmentation of access control. This allows a malicious user to create a new user account within the system.

The vulnerability of Websoft HCM’s automation solutions for HR processes is related to improper separation of access control. Exploiting this vulnerability allows a malicious actor to create a new user within the system...

PT-2023-7606 · Websoft · Websoft Hcm

Name of the Vulnerable Software and Affected Versions: Websoft HCM affected versions not specified Description: The issue is related to improper access control in the Websoft HCM system, which can be exploited by a remote attacker to create a new user in the system. Recommendations: At the moment...