665 matches found
CVE-2016-0407
Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Fusion HR Talent Integration...
CVE-2016-0407
Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Fusion HR Talent Integration...
CVE-2016-0407
CVE-2016-0407 affects Oracle PeopleSoft Enterprise HCM (Fusion HR Talent Integration) in PeopleSoft Products v9.1 and v9.2. The vulnerability is described as an unspecified issue that allows remote authenticated users to access data and compromise confidentiality. Affected component/area: Fusion ...
RuvarHRM 人力资源管理系统 accounts_list.aspx SQL注入
exp: http://oa.hnlxbus.com:8081/RuvarHRM/admin/accountslist.aspx?udepartmentid=1%27and%201%3Dconvert%28int%2C%20CHAR%28126%29%20%2b%20CHAR%28126%29%20%2b%20CHAR%28126%29%2bdbname%28%29%2b%20CHAR%28126%29%20%2b%20CHAR%28126%29%20%2b%20CHAR%28126%29%29--...
hr-iNFO - Dynamic Code Loading, External URLs, Native code usage vulnerabilities
HackApp vulnerability scanner discovered that application hr-iNFO published at the 'play' market has multiple vulnerabilities...
用友NC人力资源管理（e-HR） /hrss/rm/PositionDetail.jsp SQL注入漏洞
No description provided by source...
IRS Issues Alert for Tax Phishing Scheme
The Internal Revenue Service IRS has issued a news release addressing a new spear phishing scheme targeting payroll and human resource professionals. In this scheme, cybercriminals pose as company executives requesting personal information on employees. US-CERT encourages users and administrators...
CVE-2016-0537
Unspecified vulnerability in the Oracle Human Resources component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Person...
Ruvar人力资源管理系统select_baseinfo.aspx bt_name参数SQL注入漏洞
No description provided by source...
用友NC综合办公系统 /epp/html/nodes/upload/SupdocDo.jsp SQL注入漏洞
用友NC综合办公系统SQL注入漏洞，可同时影响多个办公系统HR资源管理系统、UFO报表系统等的数据库 注入链接：/epp/detail/publishinfomore.jsp?pkinfotype= 注入参数：pkinfotype 必须先访问/epp/index.jsp后产生cookie才能进行SQL注入 测试案例： http://nc.xhlbdc.com 访问首页产生cookie： http://nc.xhlbdc.com/epp/index.jsp...
hr-tv.ru XSS vulnerability
Vulnerable URL: http://hr-tv.ru/find/?sm=x=x=z-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 7841222 Google Pagerank| 3 VIP website status:| No Check hr-tv.ru SSL connection:|...
UNIT4TETA TETA WEB - Authorization Bypass vulnerability
Exploit for php platform in category web applications Title: UNIT4TETA TETA WEB - Authorization Bypass vulnerability Author: Lukasz Miedziński Date: 08. January 2015 CVE: CVE-2015-1173 Affected software : =================== UNIT4TETA TETA WEB 22.62.3.4 - newest version Older versions are probabl...
Threat Outbreak Alert RuleID16743: Email Messages Distributing Malicious Software on July 16, 2015
Medium Alert ID: 40020 First Published: 2015 July 17 21:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16743 may contain the following files: Name | Siz...
Microsoft Internet Explorer hr Element Uninitialized Variable Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...
用友人力资源管理软件全版本XXE漏洞
简要描述： 用友人力资源管理软件全版本XXE漏洞 详细说明： i-漏洞描述 e-hr在登陆及重置密码处理时，使用xml将用户名、密码及验证码传递给后端进行解析处理，而后端对传进来的xml文件并未作严谨验证导致，可以传进构造的恶意xml文件进行查看文件及ssrf。 由于之前提交未通过，说是与一个注入重复可能是我上次的提交说的不够详细，so不管怎样请漏洞审查者对此漏洞进行再次认真考量。谢谢 ii-漏洞证明 google/baidu搜索inurl:/hrss/login.jsp 以搜索出的ehr.mc2.cn进行演示其他的有的较敏感，有的有防火墙。 主页打开效果： 登陆抓包： POST...
用友NC综合办公系统前台再次SQL注入
简要描述： RT 详细说明： 用友NC综合办公系统SQL注入漏洞，可同时影响多个办公系统HR资源管理系统、UFO报表系统等的数据库 注入链接：/epp/detail/publishinfomore.jsp?pkinfotype= 注入参数：pkinfotype 必须先访问/epp/index.jsp后产生cookie才能进行SQL注入 漏洞证明： 测试案例： http://nc.xhlbdc.com 访问首页产生cookie： http://nc.xhlbdc.com/epp/index.jsp...
正方某系统通用型命令执行漏洞（多案例）
简要描述： 通用型。 详细说明： 涉及系统是正方软件股份有限公司的人力资源管理系统。 部分案例列举如下： http://rczp.tyut.edu.cn/xtgl/indexsessionOut.html http://202.202.160.39:8021/zftal-hrm/xtgl/loginloginpage.html http://ywxt.suoyuan.com.cn/zftal-hrm/xtgl/loginloginpage.html http://hr.tjtc.edu.cn/zftal-hrm/xtgl/loginloginpage.html...
用友人力资源管理软件SQL注入漏洞（无需登录，影响所有版本）
简要描述： 详细说明： 用友软件： 涉及客户非常多。都是大型国企、银行、能源、金融重要单位。 举例如下： 大连银行 http://zpyc.bankofdl.com 顺德农商行 http://career.sdebank.com 中国海洋石油总公司 http://zhaopin.cnooc.com.cn 北京市建筑设计研究院 www.biad.com.cn:88/ 民生银行 http://ehr.creditcard.cmbc.com.cn 中国中铁 http://61.232.6.108/ ....等等单位 直接谷歌搜 inurl:hrss/login.jsp inurl:hrss/r...
Yonyou e-HR /hrss/rm/ResetPwd.jsp SQL注入漏洞
No description provided by source...
用友人力资源管理（e-HR）SQL注入漏洞
简要描述： ----------------------------------- 说点啥 详细说明： /hrss/rm/PositionDetail.jsp文件中PKEMPTYJOB参数存在SQL注入漏洞 直接丢SQLMAP里跑： http://219.140.193.253/hrss/rm/PositionDetail.jsp?PKEMPTYJOB=1001A11000000000G9WA& GET parameter 'PKEMPTYJOB' is vulnerable. Do you want to keep testing the others if any? y/N N...