CVE-2019-18207

In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component. The payload will be triggered every time a user browses the reports page...

CVE-2019-18207

Summary: CVE-2019-18207 affects Zucchetti InfoBusiness ≤ 4.4.1. An authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component. The payload is triggered whenever users browse the reports page. Affected software: Zucchetti InfoBusi...

CVE-2019-18206

A cross-site request forgery CSRF vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload...

CVE-2019-18206

CVE-2019-18206 affects Zucchetti InfoBusiness up to version 4.4.1. The vulnerability is a cross-site request forgery (CSRF) that allows uploading arbitrary files. The available connected sources confirm the product, affected version range, and the underlying flaw (CSRF leading to arbitrary file u...

CVE-2019-18205

Multiple Reflected Cross-site Scripting XSS vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input encoded in base64. This also applies to the search functionality for the searchKey parameter...

CVE-2019-18205

CVE-2019-18205 affects Zucchetti InfoBusiness

CVE-2019-18204

CVE-2019-18204 affects Zucchetti InfoBusiness version up to 4.4.1. The issue allows any authenticated user to upload arbitrary PHP files, leading to remote code execution. The available connected sources confirm the same description across Red Hat and CNVD entries, with no public details on speci...

CVE-2019-18204

Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution...

Zucchetti HR Portal Path Traversal Vulnerability

Zucchetti HR Portal is a human resources management system. A path traversal vulnerability exists in Zucchetti HR Portal 2019-03-15 and prior versions. The vulnerability stems from a failure of a networked system or product to properly filter for specific elements in a resource or file path. An...

CVE-2019-10257

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location dot-dot-slash notation to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java...

CVE-2019-10257

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location dot-dot-slash notation to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java...

Directory traversal

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location dot-dot-slash notation to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java...

CVE-2019-10257

CVE-2019-10257 affects Zucchetti HR Portal (through 2019-03-15). It is a directory traversal/path-traversal vulnerability that allows unauthenticated users to escape restricted directories (dot-dot-slash) and read files, including the application’s Java sources under /WEB-INF/classes/*.class. NVD...

CVE-2019-10257

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location dot-dot-slash notation to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java...