CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 中6.1 |
Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. This vulnerability allows attackers to compromise session credentials via user interaction with a crafted link. |
| 28/02/2022 |
| CVE-2022-25013 | 中6.1 | Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component login.php. | 28/02/2022 |
| CVE-2021-38823 | 緊急9.8 | The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is opened in a different browser. | 04/10/2021 |
| CVE-2021-38822 | 中5.4 | A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary execution of JavaScript commands. | 04/10/2021 |
| CVE-2021-35046 | 中6.1 | A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie. | 22/06/2021 |
| CVE-2021-35045 | 中6.1 | Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint. | 22/06/2021 |
| CVE-2021-34244 | 高8.8 | A cross site request forgery (CSRF) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwords. | 22/06/2021 |
| CVE-2021-34243 | 中5.4 | A stored cross site scripting (XSS) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab. The exploit is triggered when a user visits the upload location of the crafted file. | 22/06/2021 |
| CVE-2020-6114 | 高7.2 | An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. | 10/07/2020 |
| CVE-2020-9271 | 中6.5 | ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php. | 18/02/2020 |
| CVE-2020-9270 | 高8.8 | ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php. | 18/02/2020 |
| CVE-2018-12420 | 高7.5 | IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request. | 14/06/2018 |