CVE-2021-37213

The CVE-2021-37213 entry concerns Flygo, an attendance/clocking system by Larvata. Affected component: the check-in record page where an authenticated general user can exploit an insecure direct object reference (IDOR) by altering parameters (employee ID and date) to access other employees’ check...

CVE-2021-37213 Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-2

The check-in record page of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee’s check-in record...

CVE-2021-37212

CVE-2021-37212 describes an Insecure Direct Object Reference (IDOR) in the Flygo bulletin function. The issue allows a user who is authenticated as a general user to manipulate the bulletin ID in specific URL parameters to access and modify bulletin content. The vulnerability is documented across...

CVE-2021-37212 Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1

The bulletin function of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content...

CVE-2021-37211 Larvata Digital Technology Co. Ltd. FLYGO - Stored XSS

The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks...

CVE-2021-37211

The CVE-2021-37211 entry concerns Flygo's bulletin/announcements feature that fails to filter special characters when adding a new announcement, enabling a stored XSS via input submitted with a general user credential. Attackers could inject JavaScript through the announcements field, leading to ...

CVE-2021-37215

The employee management page of Flygo contains an Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s user data by specifying that employee’s ID in the API parameter...

CVE-2021-37211

The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks...

Larvata Flygo 安全漏洞

Larvata Flygo is an attendance clocking software from Larvata Taiwan. Larvata Flygo contains Insecure Direct Object Reference has a security vulnerability that allows a remote attacker, after authenticating as a normal user, to access a specific employee's sign-in record by manipulating the...

Larvata Flygo 安全漏洞

Larvata Flygo is an attendance clocking software from Larvata Taiwan. Larvata Flygo contains Insecure Direct Object Reference has a security vulnerability that allows a remote attacker authenticated as a regular user to manipulate user data by specifying the employee's ID in an API parameter and...

Larvata Flygo 跨站脚本漏洞

Larvata Flygo is an attendance clocking software from Larvata Taiwan. Larvata Flygo suffers from a cross-site scripting vulnerability that stems from Flygo's announcements feature not filtering special characters when adding new announcements. A remote attacker can exploit this vulnerability alon...

Larvata Flygo 安全漏洞

Larvata Flygo is an attendance clocking software from Larvata Taiwan. Larvata Flygo contains Insecure Direct Object Reference has a security vulnerability that allows a remote attacker, after authenticating as a normal user, to manipulate the announcement ID in a specific Url parameter to access...