CVE-2017-7953

INFOR EAM V11.0 Build 201410 has XSS via comment fields...

CVE-2017-7952: Improper Neutralization of Special Elements used in an SQL Command

INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter...

CVE-2017-7953: Improper Neutralization of Input During Web Page Generation

INFOR EAM V11.0 Build 201410 has XSS via comment fields...

PT-2017-18024

Name of the Vulnerable Software and Affected Versions INFOR EAM version 11.0 Build 201410 Description The issue is related to SQL injection via search fields. It is specifically tied to the filtervalue parameter. Recommendations For INFOR EAM version 11.0 Build 201410, avoid using the filtervalue...

PT-2017-18025

Name of the Vulnerable Software and Affected Versions INFOR EAM version 11.0 Build 201410 Description The issue is related to a security problem where an attacker can inject malicious code via comment fields, potentially leading to unauthorized actions on the affected system. Recommendations For...

INFOR EAM 11.0 Build 201410 SQL Injection

SQL injection in INFOR EAM V11.0 Build 201410 search fields web/base/.. via filtervalue parameter ------------------- Assigned CVE: CVE-2017-7952 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to any page with a search or filter field in it for example...

INFOR EAM 11.0 Build 201410 Cross Site Scripting

Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on a record and open its page 4. Go to "Comments" tab 4. Click the add new comment...

CVE-2017-6550

Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson formerly ESBUS allow remote attackers to execute arbitrary SQL commands via the 1 TABLE parameter to esbus/servlet/GetSQLData or 2 QUERY parameter to KKLS9ReportingPortal/GetData...

Sql injection

Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson formerly ESBUS allow remote attackers to execute arbitrary SQL commands via the 1 TABLE parameter to esbus/servlet/GetSQLData or 2 QUERY parameter to KKLS9ReportingPortal/GetData...

CVE-2017-6550

Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson formerly ESBUS allow remote attackers to execute arbitrary SQL commands via the 1 TABLE parameter to esbus/servlet/GetSQLData or 2 QUERY parameter to KKLS9ReportingPortal/GetData...

CVE-2017-6550

CVE-2017-6550 affects Kinsey Infor-Lawson (formerly ESBUS). The vulnerability is a SQL injection in at least two parameters: (1) TABLE parameter to esbus/servlet/GetSQLData and (2) QUERY parameter to KK_LS9ReportingPortal/GetData. Exploitation enables remote attackers to execute arbitrary SQL com...

CVE-2017-6550: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson formerly ESBUS allow remote attackers to execute arbitrary SQL commands via the 1 TABLE parameter to esbus/servlet/GetSQLData or 2 QUERY parameter to KKLS9ReportingPortal/GetData...

PT-2017-17149

Name of the Vulnerable Software and Affected Versions Infor-Lawson formerly ESBUS versions affected versions not specified Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the TABLE parameter to th...

Multiple SQL Injection Vulnerabilities in Kinsey Infor-Lawson

Kinsey Infor-Lawson is Kinsey's effort to change the way organizations build and digest information. Kinsey Infor-Lawson suffers from multiple SQL injection vulnerabilities due to a failure to adequately validate user data before performing SQL queries. An attacker could exploit this vulnerabilit...

Kinsey Infor / Lawson / ESBUS - SQL Injection Vulnerability

Exploit for jsp platform in category web applications Exploit Title: Kinsey Infor / Lawson ESBUS - Multiple SQL Injections Date: 3/10/2017 Exploit Author: Michael Benich Vendor homepage: http://www.kinsey.com/infor-lawson.html Version: ALL Tested on: Windows Server 2008 R2; MySQL ver 5.5 CVE:...

Kinsey InforLawson ESBUS - SQL Injection

Kinsey InforLawson ESBUS - SQL Injection Exploit Title: Kinsey Infor / Lawson ESBUS - Multiple SQL Injections Date: 3/10/2017 Exploit Author: Michael Benich Vendor homepage: http://www.kinsey.com/infor-lawson.html Version: ALL Tested on: Windows Server 2008 R2; MySQL ver 5.5 CVE: CVE-2017-6550...

Kinsey's Infor-Lawson SQL Injection

Summary: Kinsey's Infor-Lawson application formerly ESBUS is vulnerable to SQL injection in at least two parameters: ------------------------------------------------------------------------ Vendor: Kinsey ------------------------------------------------------------------------ Software Link:...

Kinsey Infor/Lawson / ESBUS - SQL Injection

Exploit Title: Kinsey Infor / Lawson ESBUS - Multiple SQL Injections Date: 3/10/2017 Exploit Author: Michael Benich Vendor homepage: http://www.kinsey.com/infor-lawson.html Version: ALL Tested on: Windows Server 2008 R2; MySQL ver 5.5 CVE: CVE-2017-6550 Kinsey's Infor-Lawson application formerly...

campus2.infor.com XSS vulnerability

Vulnerable URL: https://campus2.infor.com/courses/SIMS/player.htm?file=javascript:alert%28/OPENBUGBOUNTY/%29 Details: Description| Value ---|--- Patched:| Yes, at 29.08.2017 Latest check for patch:| 29.08.2017 05:37 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank...

it.infor.com XSS vulnerability

Vulnerable URL: http://it.infor.com/InstantService/RightNow/ISemail.jsp?referer=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 18.07.2017 Latest check for patch:| 18.07.2017 21:24 GMT Vulnerability type:| XSS Vulnerability status:| Publicl...