EUVD-2017-16339

Malware in sbrugna...

Personify360 e-Business Information Disclosure Vulnerability (CNVD-2017-13143)

Personify360 e-Business is a Web-based member management system from Personify, Inc. A security vulnerability exists in Personify360 e-Business versions 7.5.2 through 7.6.1. The vulnerability can be exploited by an attacker to add vendor accounts or read vendor account data including: user names...

Design/Logic Flaw

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...

CVE-2017-7312

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data including usernames and passwords...

CVE-2017-7313

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...