Sun Ehrd vulnerabilities
6 CVEs affecting Sun Ehrd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-43360, published 2021-12-01.
More from Sun.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2021-43359, published 2021-12-01. High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days. Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to…
- CVE-2021-43360, published 2021-12-01. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access…
- CVE-2021-43358, published 2021-12-01. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download…
- CVE-2020-10508, published 2020-03-27. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information.
- CVE-2020-10510, published 2020-03-27. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access unauthorized functionality…
- CVE-2020-10509, published 2020-03-27. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), attackers can inject arbitrary command into the system and launch XSS attack.