CVE-2020-3934

CVE-2020-3934: A pre-auth SQL injection vulnerability affects a Taiwan Secom door access and personnel attendance management system. Connected sources indicate an unauthenticated attack could inject SQL commands, with high-severity impact per CVSS-3.1 (CRITICAL, 9.8) and CVSS-2 (BASE 7.5) metrics...

CVE-2020-3933

CVE-2020-3933 concerns a Taiwan SECOM door access/attendance system where attackers can enumerate user accounts. The provided data from NVD (CVSS: v3.1) indicates a network-based, low-complexity issue with no authentication required, resulting in partial confidentiality impact (C:L) and no impact...

CVE-2020-3934 TAIWAN SECOM CO., LTD. - Pre-auth SQL Injection

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command...

CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

Cross site scripting

In Kronos Web Time and Attendance webTA 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator...

Cross site scripting

A stored XSS vulnerability in Kronos Web Time and Attendance webTA affects 3.8.x and later 3.x versions before 4.0 via multiple input fields Login Message, Banner Message, and Password Instructions of the com.threeis.webta.H261configMenu servlet via an authenticated administrator...

CVE-2020-8495

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...

CVE-2020-8493

A stored XSS vulnerability in Kronos Web Time and Attendance webTA affects 3.8.x and later 3.x versions before 4.0 via multiple input fields Login Message, Banner Message, and Password Instructions of the com.threeis.webta.H261configMenu servlet via an authenticated administrator...

CVE-2020-8493

CVE-2020-8493 describes a stored XSS vulnerability in Kronos Web Time and Attendance (webTA). The issue affects version 3.8.x and later 3.x before 4.0 via multiple input fields (Login Message, Banner Message, Password Instructions) of the servlet com.threeis.webta.H261configMenu when accessed by ...

CVE-2020-8494

Kronos WebTA (webTA) 3.8.x and 3.x versions prior to 4.0 are affected by CVE-2020-8494 via the com.threeis.webta.H402editUser servlet, allowing a user with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges through parameters such as emp_id, useri...

CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

CVE-2020-8495

Kronos WebTA 3.8.x and 3.x before 4.0 contains a privilege-escalation vulnerability in the com.threeis.webta.H491delegate servlet. An attacker with Timekeeper or Supervisor privileges can exploit the delegate, delegateRole, and delegatorUserId parameters to gain unauthorized administrative privil...

CVE-2020-8495

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...

CVE-2020-8496

In Kronos Web Time and Attendance webTA 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator...

CVE-2020-8496

CVE-2020-8496 affects Kronos Web Time and Attendance (webTA). A Stored XSS vulnerability exists in the /ApplicationBanner page triggered by the Application Banner input when the user is an authenticated administrator. The issue affects webTA 4.1.x and later 4.x versions up to, but not including, ...

Information leakage vulnerability in the frontend of Yiqin General Attendance Management System V6.0

Easy attendance general attendance management system is researched and developed by Beijing Jinmapu Technology Development Co., Ltd. The system is based on B/S architecture and developed by VS.NET+SQLSERVER, which can complete the information browsing and information processing in the attendance...

SQL Injection Vulnerability in Ma***.aspx Page of Eqin WEB Attendance Management Software

Easy Attendance WEB attendance management software is a network version of the B / S architecture WEB attendance management software. The Ma.aspx page of EaseUS WEB Attendance Management Software has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive informatio...

Information leakage vulnerability in the frontend of Yiqin General Attendance Management System V6.0

Beijing Yiqin Information Technology Co., Ltd. focuses on the research of labor force attendance and working hour solutions, and creates the Yiqin labor power and working hour management platform. Information leakage vulnerability exists in the frontend of Yiqin General Attendance Management Syst...

SQL Injection Vulnerability in Attendance Management System of Zhengzhou Xinkai Pu Electronic Technology Co.

Zhengzhou New Cape Electronic Technology Co., Ltd. is a company whose main business scope includes computer system integration, development and operation and maintenance, software, smart card machine and other projects. Zhengzhou XinKaipu Electronic Technology Co., Ltd. attendance system has a SQ...

WordPress Attendance Manager plugin <= 0.5.6 - Cross-Site Request Forgery CSRF and Cross-Site Scripting (XSS) vulnerabilities

Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS vulnerabilities found in WordPress Attendance Manager plugin versions = 0.5.6. Solution Update the WordPress Attendance Manager plugin to the latest available version at least 0.5.7...