CVE-2019-16133

An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/...

EUVD-2019-6970

Malware in sbrugna...

CVE-2019-16133

An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/...

CVE-2019-16133

An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/...

Code injection

An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/...

CVE-2019-16133

An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/...

CVE-2019-16133

The CVE-2019-16133 issue affects eteams OA v4.0.34 where session handling is not strictly checked, allowing an ordinary account to obtain account names and passwords of all employees by sending a jsessionid value for URIs under app/profile/summary/. Connected sources (Red Hat RH:CVE-2019-16133 an...

泛微eteams_oa系统越权修改任意用户信息

简要描述： 泛微eteams oa系统越权修改任何新信息 详细说明： 进入https://www.eteams.cn/login/demo 然后登陆一个普通用户如图所示： 然后鼠标点击页面尚首 这个人 如图所示： 抓包得到一个链接： https://www.eteams.cn/profile/summary/8005824116863355409.json?=1408094249509 这时候我们记住8005824116863355409这个东西 我们修改本用户资料处: 我们修改一下电话，然后抓包并且把里面的employee.id替换为8005824116863355409为:...