EUVD-2017-16341

Malware in sbrugna...

EUVD-2017-16339

Malware in sbrugna...

EUVD-2017-16340

Malware in sbrugna...

Personify360 e-Business Information Disclosure Vulnerability (CNVD-2017-13143)

Personify360 e-Business is a Web-based member management system from Personify, Inc. A security vulnerability exists in Personify360 e-Business versions 7.5.2 through 7.6.1. The vulnerability can be exploited by an attacker to add vendor accounts or read vendor account data including: user names...

CVE-2017-7314

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...

Design/Logic Flaw

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...

CVE-2017-7313

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...

CVE-2017-7312

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data including usernames and passwords...

CVE-2017-7314

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...

CVE-2017-7313

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...

Authentication flaw

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...

CVE-2017-7314

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...

CVE-2017-7313

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...

CVE-2017-7314

CVE-2017-7314 affects Personify360 e-Business, versions 7.5.2–7.6.1. While creating a new role at /TabId/275, an attacker could access a list of database tables and their columns, revealing schema information due to improper access restrictions. ExploitDB evidence documents a PoC showing schema d...

CVE-2017-7313

CVE-2017-7313 affects Personify360 e-Business 7.5.2–7.6.1. The issue allows unauthenticated access to the URI /TabId/275, enabling reading of customer data (names, master Customer Ids, and emails) without authentication. The description indicates that anyone can search for users/customers in the ...

CVE-2017-7312

CVE-2017-7312 affects Personify360 e-Business v7.5.2–v7.6.1. The vulnerability exists when accessing /TabId/275, allowing unauthenticated users to add vendor accounts or read existing vendor data, including usernames and passwords. This is an information disclosure and privilege escalation-like f...

CVE-2017-7314: Improper Authentication

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...

CVE-2017-7312: Improper Privilege Management

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data including usernames and passwords...

CVE-2017-7313: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...

PT-2017-17657

Name of the Vulnerable Software and Affected Versions Personify360 e-Business versions 7.5.2 through 7.6.1 Description An issue in the software allows unauthorized access to customer information. By visiting the "/TabId/275" API endpoint, an attacker can read customer names, master Customer Ids,...