CVE-2021-34243

A stored cross site scripting XSS vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab. The exploit is triggered when a user visits the upload location of the crafted file...

Ice Hrm 跨站脚本漏洞

Ice Hrm is a human resource management system. A cross-site scripting vulnerability exists in Ice Hrm 29.0.0 OS. An attacker can exploit the vulnerability to execute arbitrary code via the /app/endpoint parameter...

Ice Hrm 跨站脚本漏洞

Ice Hrm is a human resource management system. A cross-site scripting vulnerability exists in Ice Hrm 29.0.0 OS. An attacker can exploit the vulnerability by uploading a crafted file that will result in the execution of arbitrary web script or HTML...

Ice Hrm 跨站请求伪造漏洞

Ice Hrm is a human resource management system. A security vulnerability exists in Ice Hrm 29.0.0 OS. An attacker can exploit the vulnerability to create new administrator accounts or change user passwords...

Ice Hrm 授权问题漏洞

Ice Hrm is a human resource management system. Ice Hrm suffers from a session fixation vulnerability. An attacker can exploit the vulnerability to hijack a valid user session via a specially crafted session cookie...

ICE Hrm 29.0.0.OS - (Account Takeover) Cross-Site Scripting and Session Fixation Vulnerability

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to session...

ICE Hrm 29.0.0.OS Cross Site Scripting

Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting XSS Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description The file upload feature in ICE Hrm Version 29.0.0.OS allows remote...

ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to session...

ICE Hrm 29.0.0.OS Cross Site Request Forgery

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery CSRF Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows...

ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting (XSS)

Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting XSS Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description The file upload feature in ICE Hrm Version 29.0.0.OS allows remote...

ICE Hrm 29.0.0.OS Cross Site Scripting / Session Fixation

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to session...

ICE Hrm 29.0.0.OS - (xml upload) Stored Cross-Site Scripting (XSS) Vulnerability

Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting XSS Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description The file upload feature in ICE Hrm Version 29.0.0.OS allows remote...

ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery CSRF Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows...

ICE Hrm 29.0.0.OS - (Account Takeover) Cross-Site Request Forgery (CSRF) Vulnerability

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery CSRF Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows...

SUSE: Security Advisory (SUSE-SU-2017:2173-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-11178 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.12.0-rc2+ 45 Description: A vulnerability in the Linux kernel has been resolved, which was introduced by a commit that removed the xsk buff pool from the VSI structure. This change broke the Tx side of AF XDP ...

Insecure Certificate Validation

github.com/pion/webrtc is using an insecure certificate validation. A failed DTLS certificate verification does not fail data channel communication during PeerConnection handshake. The attack requires the attacker to have knowledge of the ICE password...

Security update for nim (moderate)

openSUSE Security Update: Security update for nim Announcement ID: openSUSE-SU-2021:0618-1 Rating: moderate References: 1185083 1185084 1185085 Cross-References: CVE-2021-21372 CVE-2021-21373 CVE-2021-21374 CVSS scores: CVE-2021-21374 NVD : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affecte...

They Hacked McDonald’s Ice Cream Machines—and Started a Cold War

Secret codes. Legal threats. Betrayal. How one couple built a device to fix McDonald’s notoriously broken soft-serve machines—and how the fast-food giant froze them out...

File Upload Vulnerability in Xi'an Ice Network Technology Co.

Xi'an Ice and Snow Network Technology Co., Ltd. was established on 07/07/2014. Legal representative Gai Bing, the company's scope of business includes: web design, computer system design, computer technical services and technical consulting; Internet information services, computer hardware and...