CVE-2022-34768 Synel - eHarmony Stored XSS

insert HTML / js code inside input how to get to the vulnerable input : Workers worker nickname inject in this input the code...

Design/Logic Flaw

SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...

CVE-2022-22790: Improper Limitation of a Pathname to a Restricted Directory

SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The path exposes sensitive files that users...

PT-2022-15679

Name of the Vulnerable Software and Affected Versions SYNEL - eharmony affected versions not specified Description The issue allows an attacker to perform a Directory Traversal attack, which is aimed at gaining unauthorized access to the file system. By manipulating the Name parameter, an attacke...

PT-2022-15680

Name of the Vulnerable Software and Affected Versions SYNEL - eharmony affected versions not specified Description The issue allows an attacker to inject JS code into the comments field, potentially leading to the stealing of cookies and the loading of HTML tags and JS code onto the system. This ...

PT-2021-21322 · Synel · Synel Reports +1

Name of the Vulnerable Software and Affected Versions: SYNEL eharmonynew versions prior to 11 Synel Reports versions prior to 11 Synel Reports version 8.0.2 Description: The issue allows an attacker to log in to the system with default credentials and export a report of the eharmony system with...