CVE-2020-14982

A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database...

PT-2020-14106

Name of the Vulnerable Software and Affected Versions Kronos WebTA versions 3.8.x through 3.9.x Description A Blind SQL Injection issue affects the com.threeis.webta.H352premPayRequest servlet's SortBy parameter, allowing an attacker with the Employee, Supervisor, or Timekeeper role to read...

CVE-2020-14982: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database...

Kronos WebTA 4.0 Privilege Escalation / Cross Site Scripting

Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage: https://www.kronos.com/products/kronos-webta Version: 3.8.x - 4.0...

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage:...

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Exploit

Exploit for java platform in category web applications Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage:...

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation

Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage: https://www.kronos.com/products/kronos-webta Version: 3.8.x - 4.0...

Kronos WebTA "com.threeis.webta.H261configMenu" servlet cross-site scripting vulnerability

Kronos WebTA is an attendance system. A cross-site scripting vulnerability exists in the Kronos WebTA "com.threeis.webta.H261configMenu" servlet, which can be exploited by an attacker to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack a...

Kronos WebTA "com.threeis.webta.H491delegate" servlet elevation of privilege vulnerability (CNVD-2020-14347)

Kronos WebTA is an attendance system. A security vulnerability exists in the Kronos WebTA "com.threeis.webta.H491delegate" servlet, which can be exploited by a remote attacker to submit a special request that can elevate privileges...

Kronos WebTA /ApplicationBanner Stored Cross-Site Scripting Vulnerability

Kronos WebTA is an attendance system. A stored cross-site scripting vulnerability exists in Kronos WebTA /ApplicationBanner, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack a user session when malicio...

Kronos WebTA "com.threeis.webta.H402editUser" servlet elevation of privilege vulnerability

Kronos WebTA is an attendance system. A security vulnerability in the Kronos WebTA "com.threeis.webta.H402editUser" servlet implementation can be exploited by a remote attacker to submit a special request that can be used to gain administrative privileges...

CVE-2020-8495

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...

CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

CVE-2020-8496

In Kronos Web Time and Attendance webTA 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator...

CVE-2020-8493

A stored XSS vulnerability in Kronos Web Time and Attendance webTA affects 3.8.x and later 3.x versions before 4.0 via multiple input fields Login Message, Banner Message, and Password Instructions of the com.threeis.webta.H261configMenu servlet via an authenticated administrator...

CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Kronos webTA allow remote attackers to inject arbitrary web script or HTML via the description field to 1 servlet/com.threeis.webta.H710selProject and 2 servlet/com.threeis.webta.H720editProjectInfo. NOTE: BID:29610 states that the initial repo...

CVE-2008-6666

Multiple cross-site scripting XSS vulnerabilities in Kronos webTA allow remote attackers to inject arbitrary web script or HTML via the description field to 1 servlet/com.threeis.webta.H710selProject and 2 servlet/com.threeis.webta.H720editProjectInfo. NOTE: BID:29610 states that the initial repo...

CVE-2008-6666

Multiple cross-site scripting XSS vulnerabilities in Kronos webTA allow remote attackers to inject arbitrary web script or HTML via the description field to 1 servlet/com.threeis.webta.H710selProject and 2 servlet/com.threeis.webta.H720editProjectInfo. NOTE: BID:29610 states that the initial repo...

CVE-2008-6666: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Kronos webTA allow remote attackers to inject arbitrary web script or HTML via the description field to 1 servlet/com.threeis.webta.H710selProject and 2 servlet/com.threeis.webta.H720editProjectInfo. NOTE: BID:29610 states that the initial repo...