CVE-2021-34243

CVE-2021-34243 affects Ice Hrm 29.0.0.OS with a stored XSS flaw in the Document Management tab. A crafted file uploaded to that tab can cause arbitrary web scripts/HTML to execute when a user visits the upload location. The available sources reiterate the same condition but do not provide concret...

Ice Hrm 跨站脚本漏洞

Ice Hrm is a human resource management system. A cross-site scripting vulnerability exists in Ice Hrm 29.0.0 OS. An attacker can exploit the vulnerability by uploading a crafted file that will result in the execution of arbitrary web script or HTML...

CVE-2021-34243: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting XSS vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab. The exploit is triggered when a user visits the upload location of the crafted file...

PT-2021-20409

Name of the Vulnerable Software and Affected Versions: Ice Hrm version 29.0.0.OS Description: A cross-site request forgery issue was found, allowing attackers to create new admin accounts or change users' passwords. Recommendations: For Ice Hrm version 29.0.0.OS, update to a version that includes...

PT-2021-20808

Name of the Vulnerable Software and Affected Versions: Ice Hrm version 29.0.0.OS Description: A cross-site scripting XSS issue allows attackers to execute arbitrary code via parameters to the "/app/" endpoint. Recommendations: For Ice Hrm version 29.0.0.OS, update to a version that fixes this...

CVE-2021-35045: Improper Neutralization of Input During Web Page Generation

Cross site scripting XSS vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint...

PT-2021-20809

Name of the Vulnerable Software and Affected Versions: Ice Hrm version 29.0.0 OS Description: A session fixation issue was discovered, allowing an attacker to hijack a valid user session via a crafted session cookie. Recommendations: For Ice Hrm version 29.0.0 OS, at the moment, there is no...

CVE-2021-34244: Cross-Site Request Forgery (CSRF)

A cross site request forgery CSRF vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwords...

Ice Hrm 跨站请求伪造漏洞

Ice Hrm is a human resource management system. A security vulnerability exists in Ice Hrm 29.0.0 OS. An attacker can exploit the vulnerability to create new administrator accounts or change user passwords...

Ice Hrm 跨站脚本漏洞

Ice Hrm is a human resource management system. A cross-site scripting vulnerability exists in Ice Hrm 29.0.0 OS. An attacker can exploit the vulnerability to execute arbitrary code via the /app/endpoint parameter...

PT-2021-20408

Name of the Vulnerable Software and Affected Versions: Ice Hrm version 29.0.0.OS Description: A stored cross site scripting XSS issue was discovered, allowing attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab. The exploit is triggered...

CVE-2021-35046: Session Fixation

A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie...

Ice Hrm 授权问题漏洞

Ice Hrm is a human resource management system. Ice Hrm suffers from a session fixation vulnerability. An attacker can exploit the vulnerability to hijack a valid user session via a specially crafted session cookie...

ICE Hrm 29.0.0.OS - (Account Takeover) Cross-Site Request Forgery (CSRF) Vulnerability

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery CSRF Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows...

ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery CSRF Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows...

ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting (XSS)

Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting XSS Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description The file upload feature in ICE Hrm Version 29.0.0.OS allows remote...

ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to session...

ICE Hrm 29.0.0.OS Cross Site Request Forgery

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery CSRF Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows...

ICE Hrm 29.0.0.OS Cross Site Scripting / Session Fixation

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to session...

ICE Hrm 29.0.0.OS Cross Site Scripting

Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting XSS Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description The file upload feature in ICE Hrm Version 29.0.0.OS allows remote...