CVE-2017-17990

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

CVE-2017-17991

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

CVE-2017-17992

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...

CVE-2017-17994

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

CVE-2017-17995

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

PT-2017-15149

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

PT-2017-15145

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to the lack of proper input validation in the...

PT-2017-15147

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

PT-2017-15151

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the Last Name...

CVE-2017-17993: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

PT-2017-15148

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue allows for Arbitrary File Download via directory traversal sequences. This is achieved by manipulating the form file name parameter in a download...

CVE-2017-17995: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

PT-2017-15150

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the criteria parameter in a specific request...

PT-2017-15146

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue is related to a CSRF flaw in the Biometric Shift Employee Management System. Specifically, it affects the edit holiday action in index.php...

CVE-2017-17992: Improper Limitation of a Pathname to a Restricted Directory

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...

CVE-2017-17991: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

CVE-2017-17989: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...

CVE-2017-17990: Cross-Site Request Forgery (CSRF)

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

CVE-2017-17994: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

December 29, 2017 – Morning Cyber Coffee Headlines – “2018” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! December 29, 2017 - Headlines Carbon Black in the News: Bitcoin concerns rising...