CVE-2021-35045

Cross site scripting XSS vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint...

Cross site scripting

Cross site scripting XSS vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint...

CVE-2021-34244

A cross site request forgery CSRF vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwords...

CVE-2021-35046

A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie...

CVE-2021-35046

The CVE-2021-35046 entry concerns Ice Hrm 29.0.0 OS, where a session fixation vulnerability could allow an attacker to hijack a valid user session via a crafted session cookie. Documents in the connected set confirm the affected product/version and the core issue (session fixation), but do not pr...

CVE-2021-35045

CVE-2021-35045 is an XSS vulnerability affecting Ice Hrm 29.0.0.OS. The issue arises from unsanitized input in parameters to the /app/ endpoint, enabling attackers to inject scripts that may execute in the context of a user’s session. Documented references consistently describe Cross Site Scripti...

CVE-2021-35045

Cross site scripting XSS vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint...

CVE-2021-34244

A cross site request forgery CSRF vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwords...

CVE-2021-34244

Ice Hrm 29.0.0.OS is affected by a cross-site request forgery (CSRF) vulnerability (CVE-2021-34244) that can let an attacker create new administrator accounts or alter existing user passwords. The available connected records reiterate this impact but do not provide additional root-cause details o...

CVE-2021-34243

CVE-2021-34243 affects Ice Hrm 29.0.0.OS with a stored XSS flaw in the Document Management tab. A crafted file uploaded to that tab can cause arbitrary web scripts/HTML to execute when a user visits the upload location. The available sources reiterate the same condition but do not provide concret...

CVE-2021-34243

A stored cross site scripting XSS vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab. The exploit is triggered when a user visits the upload location of the crafted file...

Ice Hrm 跨站脚本漏洞

Ice Hrm is a human resource management system. A cross-site scripting vulnerability exists in Ice Hrm 29.0.0 OS. An attacker can exploit the vulnerability to execute arbitrary code via the /app/endpoint parameter...

Ice Hrm 跨站脚本漏洞

Ice Hrm is a human resource management system. A cross-site scripting vulnerability exists in Ice Hrm 29.0.0 OS. An attacker can exploit the vulnerability by uploading a crafted file that will result in the execution of arbitrary web script or HTML...

Ice Hrm 跨站请求伪造漏洞

Ice Hrm is a human resource management system. A security vulnerability exists in Ice Hrm 29.0.0 OS. An attacker can exploit the vulnerability to create new administrator accounts or change user passwords...

Ice Hrm 授权问题漏洞

Ice Hrm is a human resource management system. Ice Hrm suffers from a session fixation vulnerability. An attacker can exploit the vulnerability to hijack a valid user session via a specially crafted session cookie...

ICE Hrm 29.0.0.OS Cross Site Scripting

Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting XSS Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description The file upload feature in ICE Hrm Version 29.0.0.OS allows remote...

ICE Hrm 29.0.0.OS - (Account Takeover) Cross-Site Scripting and Session Fixation Vulnerability

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to session...

ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to session...

ICE Hrm 29.0.0.OS Cross Site Request Forgery

Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery CSRF Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows...

ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting (XSS)

Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting XSS Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description The file upload feature in ICE Hrm Version 29.0.0.OS allows remote...