Vulnerabilities

TI-2023-05769 CVE-2023-6282 · GHSA-h4c8-894f-qv79

Cross-Site Scripting vulnerability in IceHrm

LOW 27

IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.php, in multiple parameters.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00309 Published 2024-01-25 No fix listed CWE-79

TI-2022-09887 CVE-2022-26588 · GHSA-xrj6-96j3-q3jj

A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete…

LOW 30

A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00579 Published 2022-04-08 No fix listed CWE-352

TI-2022-08794 CVE-2022-25015 · GHSA-r4p4-4c25-8hph

A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers…

LOW 26

A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00688 Published 2022-02-28 No fix listed CWE-79

TI-2022-08793 CVE-2022-25014 · GHSA-3jm4-jjqf-q4ph

Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS)…

LOW 28

Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00716 Published 2022-02-28 No fix listed CWE-79

TI-2022-08792 CVE-2022-25013 · GHSA-8pf3-gxq5-866q

Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS)…

LOW 28

Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component login.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00716 Published 2022-02-28 No fix listed CWE-79

TI-2021-16318 CVE-2021-38823 · GHSA-v2x8-2rv7-79j3

The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue.

MEDIUM 45

The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01505 Published 2021-10-04 No fix listed CWE-613

TI-2021-16317 CVE-2021-38822 · GHSA-2v79-4vxc-6ggx

A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple…

LOW 26

A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary execution of JavaScript commands.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00743 Published 2021-10-04 No fix listed CWE-79

TI-2021-14009 CVE-2021-35046 · GHSA-5wg2-97mv-rhr7

A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an…

LOW 29

A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00764 Published 2021-06-22 No fix listed CWE-384

TI-2021-14008 CVE-2021-35045 · GHSA-qv37-4qq5-wj6c

Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to…

LOW 29

Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01052 Published 2021-06-22 No fix listed CWE-79

TI-2021-13320 CVE-2021-34244 · GHSA-xmwq-8922-3p5x

A cross site request forgery (CSRF) vulnerability was discovered in Ice Hrm 29.0.0.OS…

LOW 39

A cross site request forgery (CSRF) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwords.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0057 Published 2021-06-22 No fix listed CWE-352

TI-2021-13319 CVE-2021-34243 · GHSA-jwcp-w4cr-qpx4

A stored cross site scripting (XSS) vulnerability was discovered in Ice Hrm 29.0.0.OS…

LOW 25

A stored cross site scripting (XSS) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00595 Published 2021-06-22 No fix listed CWE-79

TI-2020-04981 CVE-2020-6114 · GHSA-8xc2-4q5w-c7h3

SQL injection in Glacies IceHRM"

LOW 35

An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) .

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01727 Published 2020-07-10 No fix listed CWE-89

TI-2020-07411 CVE-2020-9270 · GHSA-683p-wqpr-jwpc

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.

LOW 39

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00513 Published 2020-02-18 No fix listed CWE-352

TI-2020-07412 CVE-2020-9271 · GHSA-pgr8-3m3p-r5jv

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.

LOW 29

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00439 Published 2020-02-18 No fix listed CWE-352

TI-2018-08917 CVE-2018-12420 · GHSA-q973-c733-6j79

IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.

LOW 35

IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00983 Published 2018-06-14 No fix listed CWE-327

Vulnerabilities

Filters