CVE-2024-10438: Authentication Bypass Using an Alternate Path or Channel

The eHRD CTMS from Sunnet has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to bypass authentication by satisfying specific conditions in order to access certain functionalities...

Sunnet eHRD SQL注入漏洞

Sunnet Sunnet eHRD is a talent management system of China Sunnet Company. The system supports talent management and performance management, among others. Sunnet eHRD suffers from a SQL injection vulnerability. A remote attacker can exploit this vulnerability to read, modify, and delete database...

Sunnet eHRD 安全漏洞

Sunnet Sunnet eHRD is a talent management system of China Sunnet Company. The system supports talent management and performance management, among others. A security vulnerability exists in Sunnet eHRD. A remote attacker can exploit the vulnerability to modify specific parameters to access arbitra...

CVE-2024-10439: Authorization Bypass Through User-Controlled Key

The eHRD CTMS from Sunnet has an Insecure Direct Object Reference IDOR vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to access arbitrary files uploaded by any user...

CVE-2022-28740

aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor...

CVE-2022-28742

aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in the application...

CVE-2022-28740

aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor...

CVE-2022-28740

aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor...

Information disclosure

aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor...

Improper access control

aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in the application...

CVE-2022-28740

The CVE-2022-28740 entry concerns the aEnrich eHRD Learning Management Key Performance Indicator System (version 5+). Affected component/product: aEnrich eHRD LMS KPI System. Impact: exposure of sensitive information to an unauthorized actor. Exploitation details, affected versions beyond 5+, and...

CVE-2022-28742

aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in the application...

CVE-2022-28742

CVE-2022-28742 affects aEnrich eHRD Learning Management Key Performance Indicator System (version 5+). The vulnerability is improper access control: the web application does not validate user sessions on many pages, allowing an unauthenticated attacker to access sensitive functionality. Impact de...

CVE-2022-28740: Undefined Security Weakness

aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor...

CVE-2022-28742: Undefined Security Weakness

aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in the application...

PT-2022-19201 · Unknown · Aenrich Ehrd Learning Management Key Performance Indicator System

Name of the Vulnerable Software and Affected Versions: aEnrich eHRD Learning Management Key Performance Indicator System version 5+ Description: The issue concerns the exposure of sensitive information to unauthorized actors. Recommendations: For version 5+, consider restricting access to sensiti...

Sunnet eHRD Access Control Error Vulnerability

Sunnet eHRD is a talent management system from SunChat Technology, Taiwan, China. The system supports talent management and performance management, etc. Sunnet eHRD has an access control error vulnerability, which can be exploited by an attacker to access the account management page after...

Sunnet eHRD path traversal vulnerability

Sunnet eHRD is a talent management system from SunChat Technology Inc. of Taiwan, China. The system supports talent management and performance management, etc. Sunnet eHRD has a path traversal vulnerability, which can be exploited by attackers to conduct a path traversal attack to access restrict...

Sunnet eHRD Insecure Deserialization Vulnerability

Sunnet eHRD is a talent management system from Sun Chat Technology, Taiwan, China. The system supports talent management and performance management, etc. An insecure deserialization vulnerability exists in Sunnet eHRD, which stems from the inadequate input object validation and restriction of the...

CVE-2021-43359

Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt services...