Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Jun 14, 2024The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session.CVE-2024-5995 · Other software · Soar Cloud · reported by twcert@cert.org.twHigh 8.8
The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remaining valid for more than 7 days and can be reused.
- Product
- HR Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 6, 2023 Soar Cloud Ltd.CVE-2023-34357 · Other software · Soar Cloud Ltd. · reported by twcert@cert.org.twHigh 7.8
Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has the line can thus use the URL again to change the password in order to take over the account.
- Product
- HR Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Feb 17, 2021The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized.CVE-2021-22855 · Other software · Soar Cloud System Co., Ltd. · reported by twcert@cert.org.twCritical 9.8
The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands.
- Product
- HR Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Feb 17, 2021The HR Portal of Soar Cloud System fails to filter specific parameters.CVE-2021-22854 · Other software · Soar Cloud System Co., Ltd. · reported by twcert@cert.org.twHigh 7.5
The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege.
- Product
- HR Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Feb 17, 2021The HR Portal of Soar Cloud System fails to manage access control.CVE-2021-22853 · Other software · Soar Cloud System Co., Ltd. · reported by twcert@cert.org.twMedium 5.4
The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work.
- Product
- HR Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jun 19, 2019Zucchetti HR Portal through 2019-03-15 allows Directory Traversal.CVE-2019-10257 · Other software · Zucchetti · reported by MITREHigh 7.5
Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-dot-slash notation) to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java sources from /WEB-INF/classes/*.class
- Product
- HR Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.