788 matches found
CVE-2021-35968
The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges...
CVE-2021-35966
The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks...
CVE-2021-35967
The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in...
CVE-2021-35963
The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks...
CVE-2021-35965
The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in...
CVE-2021-35965: Insufficiently Protected Credentials
The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in...
CVE-2021-35968: Improper Limitation of a Pathname to a Restricted Directory
The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges...
CVE-2021-35963: Unrestricted Upload of File with Dangerous Type
The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks...
LearningDigital Orca HCM digital learning platform 安全漏洞
LearningDigital Orca HCM digital learning platform is a digital learning platform from China-based LearningDigital. A security vulnerability exists in the Orca HCM digital learning platform, which stems from the platform's use of a weak factory default administrator password, which is hard-coded...
CVE-2021-35964: Improper Authorization
The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the...
CVE-2021-35966: URL Redirection to Untrusted Site
The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks...
CVE-2021-35967: Improper Limitation of a Pathname to a Restricted Directory
The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in...
Cisco Hosted Collaboration Mediation Fulfillment Denial of Service Vulnerability
A vulnerability in the Java Management Extensions JMX component of Cisco Hosted Collaboration Mediation Fulfillment HCM-F could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected system. This vulnerability is due to an unsecured TCP/IP port. An...
CVE-2021-27605
SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last...
Authorization
SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last...
CVE-2021-27605
Summary: CVE-2021-27605 affects SAP HCM Travel Management Fiori Apps V2 (608). The issue is an improper authorization check that permits an authenticated but unauthorized user to read personnel numbers, enabling privilege escalation. The attacker can access limited personnel data (last name, firs...
CVE-2021-27605
SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last...
CVE-2021-27605: Missing Authorization
SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last...
Akamai's Technical Enablement and Education Team, Part of the Global Services and Support Organization, Wins Four Gold, Silver, and Bronze "Excellence in Education" Awards
Akamai's Technical Enablement and Education Team won four coveted Brandon Hall Group awards for excellence in learning. Akamai's win was announced on August 20, 2020. The winners are listed on Brandon Hall Group's website. The award-winning team is responsible for creating product training and...
SAP HCM Travel Management Elevation of Privilege Vulnerability
SAP HCM Travel Management is a travel management module from SAP. A security vulnerability exists in SAP HCM Travel Management that stems from a lack of authorization checks in the program. An attacker could exploit the vulnerability to elevate privileges...