CVE-2024-2636

An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espanol/updatepassword.jsp' file. Modifying the 'M4NEWPASSWORD' parameter, an attacker could store a malicious JSP file inside the file...

CVE-2024-2633

A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sitetest/english/dumpenv.jsp' is vulnerable to XSS attack by 'lang' query, i.e. '/sitetest/english/dumpenv.jsp?snoop=yes&lang=%27%3Cimg%20src/onerror=alert1%3E&params'...

CVE-2024-2634

A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/ssegenerico/genericologin.jsp' is vulnerable to XSS attack via 'lang' query, i.e. '/ssegenerico/genericologin.jsp?lang=%27%3balert%27BLEUSS%27%2f%2f&params='...

CVE-2024-2632

A Information Exposure Vulnerability has been found on Meta4 HR. This vulnerability allows an attacker to obtain a lot of information about the application such as the variables set in the process, the Tomcat versions, library versions and underlying operation system via HTTP GET...

CVE-2024-2635

The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they d...

CVE-2024-2636 Multiple vulnerabilities on Meta4 HR from Cegid

An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espanol/updatepassword.jsp' file. Modifying the 'M4NEWPASSWORD' parameter, an attacker could store a malicious JSP file inside the file...

CVE-2024-2636

The CVE-2024-2636 issue affects Cegid Meta4 HR and is an Unrestricted Upload of File vulnerability. An attacker can upload malicious files via the path /config/espanol/update_password.jsp by modifying the M4_NEW_PASSWORD parameter, enabling a potentially executed JSP file when loaded by the appli...

CVE-2024-2636 Multiple vulnerabilities on Meta4 HR from Cegid

An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espanol/updatepassword.jsp' file. Modifying the 'M4NEWPASSWORD' parameter, an attacker could store a malicious JSP file inside the file...

CVE-2024-2635 Multiple vulnerabilities on Meta4 HR from Cegid

The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they d...

CVE-2024-2635 Multiple vulnerabilities on Meta4 HR from Cegid

The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they d...

CVE-2024-2635

CVE-2024-2635 affects Cegid Meta4 HR. The root issue is that configuration pages are exposed on an Internet-facing web server, revealing file paths to the client. This is described as a vulnerability in the product’s configuration pages, with a CVSS 3.1 base score of 7.3 ( NETWORK, LOW complexity...

CVE-2024-2634 Multiple vulnerabilities on Meta4 HR from Cegid

A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/ssegenerico/genericologin.jsp' is vulnerable to XSS attack via 'lang' query, i.e. '/ssegenerico/genericologin.jsp?lang=%27%3balert%27BLEUSS%27%2f%2f&params='...

CVE-2024-2634

CVE-2024-2634 concerns Meta4 HR (Cegid) where versions up to 819.001.022 are affected by a Cross-Site Scripting (XSS) vulnerability in the endpoint /sse_generico/generico_login.jsp, exploitable via the lang query parameter (e.g., /sse_generico/generico_login.jsp?lang=%27%3balert(%27BLEUSS%27)%2f%...

CVE-2024-2634 Multiple vulnerabilities on Meta4 HR from Cegid

A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/ssegenerico/genericologin.jsp' is vulnerable to XSS attack via 'lang' query, i.e. '/ssegenerico/genericologin.jsp?lang=%27%3balert%27BLEUSS%27%2f%2f&params='...

CVE-2024-2633 Multiple vulnerabilities on Meta4 HR from Cegid

A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sitetest/english/dumpenv.jsp' is vulnerable to XSS attack by 'lang' query, i.e. '/sitetest/english/dumpenv.jsp?snoop=yes&lang=%27%3Cimg%20src/onerror=alert1%3E&params'...

CVE-2024-2633

CVE-2024-2633 affects Meta4 HR versions 819.001.022 and earlier. The vulnerability is a Cross-Site Scripting (XSS) in the endpoint /sitetest/english/dumpenv.jsp, exploitable via the lang query parameter (example: /dumpenv.jsp?snoop=yes&lang=%27%3Cimg%20src/onerror=alert(1)%3E&params). Affects the...

CVE-2024-2633 Multiple vulnerabilities on Meta4 HR from Cegid

A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sitetest/english/dumpenv.jsp' is vulnerable to XSS attack by 'lang' query, i.e. '/sitetest/english/dumpenv.jsp?snoop=yes&lang=%27%3Cimg%20src/onerror=alert1%3E&params'...

CVE-2024-2632 Information Exposure Vulnerability on Meta4 HR

A Information Exposure Vulnerability has been found on Meta4 HR. This vulnerability allows an attacker to obtain a lot of information about the application such as the variables set in the process, the Tomcat versions, library versions and underlying operation system via HTTP GET...

CVE-2024-2632

Summary: CVE-2024-2632 is an information-exposure vulnerability in Meta4 HR exposed via HTTP GET to /sitetest/english/dumpenv.jsp. The endpoint reportedly leaks substantial environment details, including process variables, Tomcat version, library versions, and underlying OS. Sources across NVD/CV...

CVE-2024-2632 Information Exposure Vulnerability on Meta4 HR

A Information Exposure Vulnerability has been found on Meta4 HR. This vulnerability allows an attacker to obtain a lot of information about the application such as the variables set in the process, the Tomcat versions, library versions and underlying operation system via HTTP GET...