CVE-2017-17992

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...

CVE-2017-17991

CVE-2017-17991 affects Biometric Shift Employee Management System, with a stored/reflected XSS in the expense_name parameter of the index.php?user=expenses request. Documents confirm XSS vulnerability but do not provide exploit details, affected versions, or remediation steps.

CVE-2017-17995

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17995

Biometric Shift Employee Management System is affected by a stored/reflected XSS via the Last_Name parameter in the index.php?user=ajax request. The issue, reported across multiple sources (NVD/CNVD/CVELIST, etc.), is caused by improper sanitization of user-supplied input leading to script inject...

CVE-2017-17994

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

CVE-2017-17991

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

CVE-2017-17993

Biometric Shift Employee Management System is affected by a cross-site scripting (XSS) vulnerability exposed via the amount parameter in the index.php?user=addition_deduction request. NVD records show XSS with CVSS v2 base score 3.5 (LOW) and a CVSS v3 base score of 5.4 (MEDIUM); attack vector is...

CVE-2017-17994

Biometric Shift Employee Management System has an XSS vulnerability in the criteria parameter accessible via index.php?user=competency_criteria. The issue is a cross-site scripting flaw described in CNVD-2018-01396 and corroborated by related records, allowing injected scripts to be executed in a...

CVE-2017-17989

The vulnerability described for CVE-2017-17989 affects the Biometric Shift Employee Management System. The issue is a Cross-Site Scripting (XSS) flaw that can be triggered via the index.php holiday_name parameter in the edit_holiday action. According to the available data, this is the scope, with...

CVE-2017-17990

Biometric Shift Employee Management System is affected by a CSRF vulnerability in the edit_holiday action controlled by index.php. The issue originates fromCross-Site Request Forgery via the edit_holiday operation, enabling unauthorized requests to potentially change holiday data. The CVE entry c...

Biometric Shift Employee Management System File Read Limit Bypass Vulnerability

Biometric Shift Employee Management System is an employee management system. A file read restriction bypass vulnerability exists in Biometric Shift Employee Management System 3.0. A remote attacker can bypass the expected file read restriction via a user=download request with pathname in the path...

CVE-2017-17876

Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter...

CVE-2017-17876

Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter...

Design/Logic Flaw

Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter...

Biometric Shift Employee Management System 3.0 - Local File Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: Biometric Shift Employee Management System 3.0 - Local File Download Dork: N/A Date: 24.12.2017 Vendor Homepage: https://www.shiftsystems.net/ Software Link:...

CVE-2017-17876

Biometric Shift Employee Management System 3.0 is affected. The vulnerability lets remote attackers bypass file-read restrictions via a user=download request with a pathname in the path parameter, enabling local file disclosure. This is corroborated by CNVD/NVD entries and Exploit-DB references (...

Biometric Shift Employee Management System 3.0 - Local File Disclosure

Biometric Shift Employee Management System 3.0 - Local File Disclosure Exploit Title: Biometric Shift Employee Management System 3.0 - Local File Download Dork: N/A Date: 24.12.2017 Vendor Homepage: https://www.shiftsystems.net/ Software Link:...

Biometric Shift Employee Management System 3.0 Local File Disclosure

Exploit Title: Biometric Shift Employee Management System 3.0 - Local File Download Dork: N/A Date: 24.12.2017 Vendor Homepage: https://www.shiftsystems.net/ Software Link: https://codecanyon.net/item/white-label-shift-employee-management-system/21061908 Version: 3.0 Category: Webapps Tested on:...

Biometric Shift Employee Management System 3.0 - Local File Disclosure

Exploit Title: Biometric Shift Employee Management System 3.0 - Local File Download Dork: N/A Date: 24.12.2017 Vendor Homepage: https://www.shiftsystems.net/ Software Link: https://codecanyon.net/item/white-label-shift-employee-management-system/21061908 Version: 3.0 Category: Webapps Tested on:...

How to try to predict the output of Micali-Schnorr Generator (MS-DRBG) knowing the factorization. Part II

See also Part I and Part III of this series tl;dr In the previous article of the same series we tried to predict the output of Micali-Schnorr Generator MS-DRBG knowing the factorization. In this blog post we continue the effort started in part I showing different strategies. If you want to skip a...