EUVD-2002-0576

Malware in sbrugna...

EUVD-2002-0579

Malware in sbrugna...

CVE-2002-0579

WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminproc.asp script, which does not prompt for a password...

CVE-2002-0580

WorkforceROI Xpede 4.1 allows remote attackers to obtain the database username via a request to datasource.asp, which leaks the username in a form and allows the attacker to more easily conduct brute force password guessing attacks...

CVE-2002-0581

WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database via the Qry parameter in the sprc.asp script...

CVE-2002-0584

WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the tsappprocess.asp script, which is easily guessable because it is incremented by 1 for each new timesheet...

CVE-2002-0579

WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminproc.asp script, which does not prompt for a password...

CVE-2002-0584

The CVE-2002-0584 entry concerns WorkforceROI Xpede 4.1. The vulnerability allows remote attackers to read user timesheets by tampering with the TSN ID parameter in the ts_app_process.asp script. The TSN ID is easily guessable because it is incremented by 1 for each new timesheet, enabling an att...

CVE-2002-0579

The CVE covers WorkforceROI Xpede 4.1, where the /admin/adminproc.asp script allows remote attackers to gain Xpede administrator privileges without prompting for a password. The underlying issue is an authentication bypass in that admin endpoint, enabling privilege escalation. The sources confirm...

CVE-2002-0581

WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database via the Qry parameter in the sprc.asp script...

CVE-2002-0580

The CVE-2002-0580 entry concerns WorkforceROI Xpede 4.1. The provided materials indicate that remote attackers can obtain the database username by requesting datasource.asp, which leaks the username in a form. This exposure can facilitate easier brute-force password guessing attacks against the d...

CVE-2002-0584

WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the tsappprocess.asp script, which is easily guessable because it is incremented by 1 for each new timesheet...

CVE-2002-0583

CVE-2002-0583 affects WorkforceROI Xpede 4.1. The vulnerability stems from using a small random namespace (5 alphanumeric chars) for temporary expense claim reports stored under /reports/temp, enabling remote attackers to read these reports through brute-force access. Impact described as confiden...

CVE-2002-0582

WorkforceROI Xpede 4.1 stores temporary expense claim reports in a world-readable and indexable /reports/temp directory, which allows remote attackers to read the reports by accessing the directory...

CVE-2002-0583

WorkforceROI Xpede 4.1 uses a small random namespace 5 alphanumeric characters for temporary expense claim reports in the /reports/temp directory, which allows remote attackers to read the reports via a brute force attack...

CVE-2002-0581: Undefined Security Weakness

WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database via the Qry parameter in the sprc.asp script...

CVE-2002-0579: Undefined Security Weakness

WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminproc.asp script, which does not prompt for a password...

CVE-2002-0584: Undefined Security Weakness

WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the tsappprocess.asp script, which is easily guessable because it is incremented by 1 for each new timesheet...

CVE-2002-0582: Undefined Security Weakness

WorkforceROI Xpede 4.1 stores temporary expense claim reports in a world-readable and indexable /reports/temp directory, which allows remote attackers to read the reports by accessing the directory...

CVE-2002-0583: Undefined Security Weakness

WorkforceROI Xpede 4.1 uses a small random namespace 5 alphanumeric characters for temporary expense claim reports in the /reports/temp directory, which allows remote attackers to read the reports via a brute force attack...