Code injection

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

CVE-2019-12773

An issue was discovered in Verint Impact 360 15.1. At wfo/help/helppopup.jsp, the helpURL parameter can be changed to embed arbitrary content inside of an iFrame. Attackers may use this in conjunction with social engineering to embed malicious scripts or phishing pages on a site where this produc...

CVE-2019-12773

The CVE-2019-12773 issue affects Verint Impact 360 15.1, specifically the wfo/help/help_popup.jsp page where the helpURL parameter can be manipulated to embed arbitrary content inside an iframe. Root cause is improper handling of the helpURL parameter, enabling an attacker to craft a link that co...

CVE-2019-12784

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

CVE-2019-12784

Verint Impact 360 15.1 (wfo/control/signin) has a login form that accepts submissions from external websites, enabling a possible cross-site flow that, together with CVE-2019-12783, could be used to crowdsource bruteforce login attempts against valid credentials without originating traffic from t...

CVE-2019-12783

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successful login. In conjunction with CVE-2019-12784, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site,...

CVE-2019-12783

CVE-2019-12783 (Verint Impact 360 15.1) is an open redirect at wfo/control/signin where the rd parameter can accept a URL, enabling redirection after login. When paired with CVE-2019-12784 (external submissions in the login form), this can be used to crowdsource bruteforce login attempts on the t...

Verint Impact 360 15.1 Script Insertion / HTML Injection

!-- Exploit Title: Verint Impact 360 Open iFrame Date: 7-13-2020 Exploit Author: Ryan Delaney Author Contact: [email protected] Author LinkedIn: https://www.linkedin.com/in/infosecrd/ Vendor Homepage: https://www.verint.com/ Software Link:...

Verint Impact 360 15.1 Open Redirect

!-- Exploit Title: Verint Impact 360 onLogin open redirect Date: 7-13-2020 Exploit Author: Ryan Delaney Author Contact: [email protected] Author LinkedIn: https://www.linkedin.com/in/infosecrd/ Vendor Homepage: https://www.verint.com/ Software Link:...

Verint Impact 360 15.1 Cross Site Request Forgery

!-- Exploit Title: Verint Impact 360 login CSRF Date: 7-13-2020 Exploit Author: Ryan Delaney Author Contact: [email protected] Author LinkedIn: https://www.linkedin.com/in/infosecrd/ Vendor Homepage: https://www.verint.com/ Software Link:...

Verint Workforce Optimization (WFO) Injection Vulnerability

Verint Workforce Optimization is a unified suite of software and services for capturing interactions and managing employee performance across an enterprise or target area. A security vulnerability exists in Verint Workforce Optimization WFO version 15.2. An attacker could exploit the vulnerabilit...

CVE-2020-13480

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

CVE-2020-13480

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

Design/Logic Flaw

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

CVE-2020-13480

The connected records confirm CVE-2020-13480 affects Verint Workforce Optimization (WFO) version 15.2 and is caused by HTML injection via the Send Email feature. The vulnerability details indicate an injection in a functional path that could affect email composition/handling within WFO. No exploi...

CVE-2020-13480

Verint Workforce Optimization WFO 15.2 allows HTML injection via the "send email" feature...

Collaboration Compliance And Quality Management Platform 9.1.1.5482 Improper Access Control

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2018-024 Product: Collaboration Compliance and Quality Management Platform Manufacturer: Verint Verba Affected Versions: = 9.1.1.5482 Tested Versions: 9.1.1.5482 Vulnerability Type: Improper Access Control CWE-284 Risk Level: Mediu...

Verint Impact 360 11.1 Open Redirect

URL Redirection Vulnerability In Verint Impact 360 Overview ======== Title : URL Redirection Vulnerability In Verint Impact 360 Author: Sanehdeep Singh Plugin Homepage: http://www.verint.com Severity: Medium Version Affected: 11.1 Version patched: Patches available. Contact Vendor Description...

Verint Impact 360 11.1 Cross Site Scripting

Overview ======== Title : Cross Site Scripting Vulnerability In Verint Impact 360 Author: Sanehdeep Singh Plugin Homepage: http://www.verint.com Severity: Medium Version Affected: 11.1 Version patched: Patches available. Contact Vendor Description =========== About the Product =================...

Israel's Verint Systems get a contract from Indian government for interception program

Soon in December this year, India's new surveillance program - Centralized Monitoring System CMS will be able to analyze all telecommunications and Internet communications in India by the government and its agencies. This means that everything we say or text over the phone, write, post or browse...