Vendor
lenve
11 known vulnerabilities.
3 results · Clear filters · Feed
-
High 7.3
lenve vhr vhr.sql default credentials
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly av…
-
High 8.1
vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts in…
-
High 7.5
vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in…