Cross site scripting

Kofax Front Office Server version 4.1.1.11.0.5212 both Thin Client and Administration Console suffers from multiple authenticated stored XSS vulnerabilities via the 1 "Filename" field in /Kofax/KFS/ThinClient/document/upload/ - Thin Client or 2 "DeviceName" field in...

Design/Logic Flaw

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...

CVE-2018-17287

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...

CVE-2018-17289

CVE-2018-17289 affects Kofax Front Office Server Administration Console version 4.1.1.11.0.5212. The vulnerability is an XML external entity (XXE) flaw in the imported package configuration workflow (ZIP uploaded via Kofax/KFS/Admin/PackageService/package/upload) that allows remote authenticated ...

CVE-2018-17289

An XML external entity XXE vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration .ZIP file within the Kofax/KFS/Admin/PackageService/package/uploa...

CVE-2018-17288

Kofax Front Office Server version 4.1.1.11.0.5212 both Thin Client and Administration Console suffers from multiple authenticated stored XSS vulnerabilities via the 1 "Filename" field in /Kofax/KFS/ThinClient/document/upload/ - Thin Client or 2 "DeviceName" field in...

CVE-2018-17288

The CVE-2018-17288 entry concerns Kofax Front Office Server 4.1.1.11.0.5212 (Thin Client and Administration Console). The vulnerability class is authenticated stored XSS via: (1) Filename field in /Kofax/KFS/ThinClient/document/upload/ (Thin Client) and (2) DeviceName field in /Kofax/KFS/Admin/De...

CVE-2018-17287

CVE-2018-17287 affects Kofax Front Office Server Administration Console (version 4.1.1.11.0.5212). The issue arises because some fields (e.g., passwords) are obfuscated in the front-end but can be exfiltrated via the back-end download feature (mfp.password downloadsettingvalue operation). This co...

CVE-2018-17287

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...

PT-2019-9451

Name of the Vulnerable Software and Affected Versions Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 Description A vulnerability exists that allows remote authenticated users to read arbitrary files. This is achieved by crafting XML inside an imported package configurati...

CVE-2018-17288: Improper Neutralization of Input During Web Page Generation

Kofax Front Office Server version 4.1.1.11.0.5212 both Thin Client and Administration Console suffers from multiple authenticated stored XSS vulnerabilities via the 1 "Filename" field in /Kofax/KFS/ThinClient/document/upload/ - Thin Client or 2 "DeviceName" field in...

CVE-2018-17287: Missing Encryption of Sensitive Data

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...

CVE-2018-17289: Improper Restriction of XML External Entity Reference

An XML external entity XXE vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration .ZIP file within the Kofax/KFS/Admin/PackageService/package/uploa...

PT-2019-9450

Name of the Vulnerable Software and Affected Versions Kofax Front Office Server version 4.1.1.11.0.5212 Description The issue concerns multiple authenticated stored XSS vulnerabilities. These can be exploited via the "Filename" field in the "/Kofax/KFS/ThinClient/document/upload/" endpoint for th...

PT-2019-9449

Name of the Vulnerable Software and Affected Versions Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 Description The issue allows for the exfiltration of sensitive information, such as passwords, which are obfuscated in the front-end but can be accessed in cleartext...

Unspecified Vulnerability in Oracle PeopleSoft Products PeopleSoft Enterprise FSCM Component (CNVD-2017-31841)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise FSCM is one of the financial and supply chain management components. An...

Unspecified Vulnerability in Oracle PeopleSoft Products PeopleSoft Enterprise FSCM Component

Oracle PeopleSoft is a set of enterprise human capital management solutions from Oracle, which provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise FSCM is one of the financial and supply chain management components. An unspecified...

CVE-2017-10426

Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products subcomponent: Staffing Front Office. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2017-10164

Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products subcomponent: Staffing Front Office. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2017-10164

Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products subcomponent: Staffing Front Office. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...