CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

Cross site scripting

In Kronos Web Time and Attendance webTA 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator...

CVE-2020-8493

CVE-2020-8493 describes a stored XSS vulnerability in Kronos Web Time and Attendance (webTA). The issue affects version 3.8.x and later 3.x before 4.0 via multiple input fields (Login Message, Banner Message, Password Instructions) of the servlet com.threeis.webta.H261configMenu when accessed by ...

CVE-2020-8494

Kronos WebTA (webTA) 3.8.x and 3.x versions prior to 4.0 are affected by CVE-2020-8494 via the com.threeis.webta.H402editUser servlet, allowing a user with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges through parameters such as emp_id, useri...

CVE-2020-8496

CVE-2020-8496 affects Kronos Web Time and Attendance (webTA). A Stored XSS vulnerability exists in the /ApplicationBanner page triggered by the Application Banner input when the user is an authenticated administrator. The issue affects webTA 4.1.x and later 4.x versions up to, but not including, ...