Kronos WebTA SQL Injection Vulnerability

Kronos WebTA is an attendance system. Kronos WebTA suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to read sensitive data from the database...

CVE-2020-14982

A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database...

CVE-2020-14982

A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database...

Sql injection

A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database...

CVE-2020-14982

CVE-2020-14982 describes a Blind SQL Injection in Kronos WebTA 3.8.x and later until 4.0, affecting the com.threeis.webta.H352premPayRequest servlet’s SortBy parameter. An attacker with the Employee, Supervisor, or Timekeeper role can read sensitive data from the database. The available connected...

CVE-2020-14982

A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database...

On Marcus Hutchins

Long and nuanced story about Marcus Hutchins, the British hacker who wrote most of the Kronos malware and also stopped WannaCry in real time. Well worth reading...

Kronos 4500 Time Clock Default Credentials (FTP)

Kronos 4500 Time Clock FTP service has default credentials set. Copyright C 2020 Simmons Foods, Inc. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Softwar...

Kronos 4500 Time Clock Default Credentials (Telnet)

Kronos 4500 Time Clock has default credentials set. SPDX-FileCopyrightText: 2020 Simmons Foods, Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Kronos WebTA 4.0 Privilege Escalation / Cross Site Scripting

Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage: https://www.kronos.com/products/kronos-webta Version: 3.8.x - 4.0...

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Exploit

Exploit for java platform in category web applications Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage:...

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage:...

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation

Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage: https://www.kronos.com/products/kronos-webta Version: 3.8.x - 4.0...

Kronos WebTA "com.threeis.webta.H261configMenu" servlet cross-site scripting vulnerability

Kronos WebTA is an attendance system. A cross-site scripting vulnerability exists in the Kronos WebTA "com.threeis.webta.H261configMenu" servlet, which can be exploited by an attacker to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack a...

Kronos WebTA "com.threeis.webta.H402editUser" servlet elevation of privilege vulnerability

Kronos WebTA is an attendance system. A security vulnerability in the Kronos WebTA "com.threeis.webta.H402editUser" servlet implementation can be exploited by a remote attacker to submit a special request that can be used to gain administrative privileges...

Kronos WebTA /ApplicationBanner Stored Cross-Site Scripting Vulnerability

Kronos WebTA is an attendance system. A stored cross-site scripting vulnerability exists in Kronos WebTA /ApplicationBanner, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack a user session when malicio...

Kronos WebTA "com.threeis.webta.H491delegate" servlet elevation of privilege vulnerability (CNVD-2020-14347)

Kronos WebTA is an attendance system. A security vulnerability exists in the Kronos WebTA "com.threeis.webta.H491delegate" servlet, which can be exploited by a remote attacker to submit a special request that can elevate privileges...

CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

CVE-2020-8496

In Kronos Web Time and Attendance webTA 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator...