Harris Computer Ormed Self Service Information Disclosure Vulnerability

Harris Computer Ormed Self Service is a suite of self-service software from Harris Computer USA. An information disclosure vulnerability exists in Harris Computer Ormed Self Service versions prior to 2019.1.4. An attacker can exploit this vulnerability by sending an arbitrary 'empNo' parameter...

CVE-2019-18626

Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo value to the ORMEDMIS/Data/PY/T4W2Service.svc/RetrieveW2EntriesForEmployee URI, thus exposing sensitive information including employee tax information, social...

CVE-2019-18626

Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo value to the ORMEDMIS/Data/PY/T4W2Service.svc/RetrieveW2EntriesForEmployee URI, thus exposing sensitive information including employee tax information, social...

CVE-2019-18626

Affected product: Harris Ormed Self Service, prior to 2019.1.4. Vulnerability core: authenticated users can supply an arbitrary empNo to the URI RetrieveW2EntriesForEmployee under ORMEDMIS/Data/PY/T4W2Service.svc/ RetrieveW2EntriesForEmployee, leading to disclosure of W-2 forms and sensitive data...

CVE-2019-18626: Authorization Bypass Through User-Controlled Key

Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo value to the ORMEDMIS/Data/PY/T4W2Service.svc/RetrieveW2EntriesForEmployee URI, thus exposing sensitive information including employee tax information, social...