CVE-2022-23856

CVE-2022-23856 affects Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. The issue is due to allowing an attacker to enumerate users by manipulating the id parameter in the ECM/maintenance/forgotpasswordstep1 endpoint. The vulnerability arises from improper validation/handling of the id paramete...

CVE-2021-34683

An issue was discovered in EXCELLENT INFOTEK CORPORATION EIC E-document System 3.0. A remote attacker can use kw/auth/bbs/asp/getuseremailinfobbs.asp to obtain the contact information name and e-mail address of everyone in the entire organization. This information can allow remote attackers to...

Information disclosure

An issue was discovered in EXCELLENT INFOTEK CORPORATION EIC E-document System 3.0. A remote attacker can use kw/auth/bbs/asp/getuseremailinfobbs.asp to obtain the contact information name and e-mail address of everyone in the entire organization. This information can allow remote attackers to...

CVE-2021-34683

CVE-2021-34683 affects EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0. A remote attacker can access the endpoint kw/auth/bbs/asp/get_user_email_info_bbs.asp to obtain the contact information (names and e-mail addresses) of everyone in the organization, enabling social engineering or br...

CVE-2021-22859

The users’ data querying function of EIC e-document system does not filter the special characters which resulted in remote attackers can inject SQL syntax and execute arbitrary commands without privilege...

Privilege escalation

The users’ data querying function of EIC e-document system does not filter the special characters which resulted in remote attackers can inject SQL syntax and execute arbitrary commands without privilege...

CVE-2021-22860 EIC e-document system - Broken Authentication

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary...

CVE-2021-22860

CVE-2021-22860 affects the EIC e-document system (Excellent Infotek Corporation). The vulnerability arises from incomplete identity verification when sorting and filtering personnel data, allowing a remote attacker to obtain user credentials without logging in and potentially gain privileged perm...

CVE-2021-22859 EIC e-document system - SQL Injection

The users’ data querying function of EIC e-document system does not filter the special characters which resulted in remote attackers can inject SQL syntax and execute arbitrary commands without privilege...

CVE-2021-22859

CVE-2021-22859 affects the EIC e-document system: the data querying function does not filter special characters, enabling SQL injection. The root cause is improper input filtering in the query path, allowing remote attackers to inject SQL syntax and execute arbitrary commands without privileges. ...

eic-game.com Cross Site Scripting vulnerability OBB-1279127

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...