PT-2023-15482

Name of the Vulnerable Software and Affected Versions Serenissima Informatica Fast Checkin version 1.0 Description An arbitrary file write issue allows unauthenticated attackers to upload malicious files in the web root of the application, potentially gaining access to the server via a web shell...

CVE-2022-47769

An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root of the application to gain access to the server via the web shell...

CVE-2022-47770: Improper Neutralization of Special Elements used in an SQL Command

Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection...

CVE-2022-47770

CVE-2022-47770 affects Serenissima Informatica Fast Checkin v1.0 and is due to an Unauthenticated SQL Injection vulnerability. The issue exposes high-severity impact across confidentiality, integrity, and availability (CVSS v3.1 base score 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Documented det...

CVE-2022-47768

Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal...

CVE-2022-47770

Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection...

unityinformatica.com.br Cross Site Scripting vulnerability OBB-2621451

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Equifax-vdp: RXSS on https://equifax.gr8people.com on Password Reset page in the username parameter

Hello, While testing your program i came across a website that is owned by informatica and is vulnerable to RXSS on Password Reset page in the username parameter POC:...

Informatica: CVE-2021-40870 in [███]

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. The IP has a SSL certificate pointing to Informatica LLC. curl -kvI...

Informatica: Cross site scripting

Researcher identified a XSS vulnerability in a service used by Informatica. Informatica worked with the vendor to patch their service for us and all other customers of the vendor. Thanks rawezhali for your responsible disclosure...

Informatica: loing in to marketplace panel on enablement.informatica.com

hello dear support I have found the issue and you can log in in to panel with any password and username F1163976 url: https://enablement.informatica.com/marketplace/ F1163979 Impact Can gain access to admin panel...

Informatica: Blind SQL injection at tsftp.informatica.com

The parameter refreshtoken sent to the REST path /api/v1/token is vulnerable to blind SQL injection. Compare the response time of these 2 requests: $ time curl -X POST "https://tsftp.informatica.com/api/v1/token" -H "accept: application/json" -H "Content-Type: application/x-www-form-urlencoded" -...

Informatica: Improper Sanitization leads to XSS Fire on admin panel

Summary Because the HTML is not sanitized when taking the input on https://accounts.informatica.com/registration.html, the input is vulnerable to XSS. When a payload such as " is put into the form under company it triggers a blind xss. When the payload successfully is loaded, it dumps information...

Informatica: Cross-site Scripting (XSS) - DOM - iqcard.informatica.com

Hello all I found a DOM based XSS at iqcard.informatica.com Description After finding the path iqcard.informatica.com/pub/fujitsu/fm3v2/player/attach.html. I noticed that the code inside attach.html was vulnerable to DOM XSS, due to the fact of the javascript document.location function. search. T...

Informatica: jira discloser information

The ticket raising system used by informatica suffers from an informational vulnerability where in an attacker can view certain details about open bugs or project information of informatica. Details include names and potentially and ticket names which an unauthorized personnel can view without...

Informatica: XXE through injection of a payload in the XMP metadata of a JPEG file

Users are able to change their avatar picture. The avatar picture upload functionality is prone to a XXE attack when parsing the image file. Specifically, the XXE attack is executed through the injection of a payload in the "XMP metadata" of the uploaded JPEG file. Proof of concept note the "Burp...

Informatica: RXSS in http://procurement-businesscatalog.informatica.com

Hi, this is a simple XSS in the host below: Reproduction Steps Visit the following URL: http://procurement-businesscatalog.informatica.com/JPBC/login.hbc?lang=%3C/SCRIPT%3E%3CSCRIPT%3Ealertdocument.domain;%3C/SCRIPT%3E F760997 Impact Standard XSS impact...

Informatica: accounts.informatica.com - RCE due to exposed Groovy console

Researcher identified a misconfigured "Groovy" panel on an AEM web application that was vulnerable to RCE. The panel was subsequently disabled...

Informatica: Public Github Repo Leaking Internal Credentials Leading To DiscoveryIQ Docker Access

Researcher has identified and reported public github repo leaking internal information...

WordPress Satoshi 2.0 Cross Site Request Forgery / File Upload

Exploit Title : WordPress Satoshi Themes 2.0 CSRF Arbitrary File Upload Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 05/06/2019 Vendor Homepage : vooshthemes.com - tecnoge.com - netsons.com WordPress Affected Versions : 4.7.13 - 3.4.2 Theme Affected Version :...