18 matches found
EUVD-2017-16341
Malware in sbrugna...
EUVD-2017-16339
Malware in sbrugna...
EUVD-2017-16340
Malware in sbrugna...
Personify360 e-Business Information Disclosure Vulnerability (CNVD-2017-13143)
Personify360 e-Business is a Web-based member management system from Personify, Inc. A security vulnerability exists in Personify360 e-Business versions 7.5.2 through 7.6.1. The vulnerability can be exploited by an attacker to add vendor accounts or read vendor account data including: user names...
CVE-2017-7312
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data including usernames and passwords...
CVE-2017-7313
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...
CVE-2017-7314
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...
CVE-2017-7313
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...
Authentication flaw
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...
Design/Logic Flaw
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...
CVE-2017-7314
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...
CVE-2017-7312
CVE-2017-7312 affects Personify360 e-Business v7.5.2–v7.6.1. The vulnerability exists when accessing /TabId/275, allowing unauthenticated users to add vendor accounts or read existing vendor data, including usernames and passwords. This is an information disclosure and privilege escalation-like f...
CVE-2017-7314
CVE-2017-7314 affects Personify360 e-Business, versions 7.5.2–7.6.1. While creating a new role at /TabId/275, an attacker could access a list of database tables and their columns, revealing schema information due to improper access restrictions. ExploitDB evidence documents a PoC showing schema d...
CVE-2017-7313
CVE-2017-7313 affects Personify360 e-Business 7.5.2–7.6.1. The issue allows unauthenticated access to the URI /TabId/275, enabling reading of customer data (names, master Customer Ids, and emails) without authentication. The description indicates that anyone can search for users/customers in the ...
CVE-2017-7314
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available...
CVE-2017-7313
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...
Personify360 7.5.2/7.6.1 - Improper Database Schema Access Restrictions
Exploit Title: Discover all tables and columns in database when creating new customer role Date: 3/29/2017 Exploit Author: Pesach Zirkind Vendor Homepage: https://personifycorp.com/ Version: 7.5.2 - 7.6.1 Tested on: Windows all versions CVE : CVE-2017-7314 Category: webapps 1. Description Any...
Personify360 7.5.27.6.1 - Improper Access Restrictions
Personify360 7.5.27.6.1 - Improper Access Restrictions Exploit Title: Access and read and create vendor / API credentials in plaintext Date: 3/29/2017 Exploit Author: Pesach Zirkind Vendor Homepage: https://personifycorp.com/ Version: 7.5.2 - 7.6.1 Tested on: Windows all versions CVE :...