EUVD-2017-9132

Malware in sbrugna...

Server side request forgery (ssrf)

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17990

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

CVE-2017-17994

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

CVE-2017-17993

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17995

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17995

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17994

Biometric Shift Employee Management System has an XSS vulnerability in the criteria parameter accessible via index.php?user=competency_criteria. The issue is a cross-site scripting flaw described in CNVD-2018-01396 and corroborated by related records, allowing injected scripts to be executed in a...

CVE-2017-17990

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

CVE-2017-17993

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17992

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...

PT-2017-15149

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

PT-2017-15145

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to the lack of proper input validation in the...

PT-2017-15147

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

PT-2017-15151

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the Last Name...

PT-2017-15150

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the criteria parameter in a specific request...

CVE-2017-17995: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

PT-2017-15146

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue is related to a CSRF flaw in the Biometric Shift Employee Management System. Specifically, it affects the edit holiday action in index.php...

PT-2017-15148

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue allows for Arbitrary File Download via directory traversal sequences. This is achieved by manipulating the form file name parameter in a download...

CVE-2017-17993: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...