web time and attendance vulnerabilities and fixes

Recent CVEs affecting web time and attendance, with upgrade or downgrade steps. 6 tracked.

Also searched as: webtimeandattendance.

web time and attendance has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2020-12-21. Highest priority: CVE-2020-35604 (score 63/100).

• CVE-2020-8496 MEDIUM 4.8 UPGRADE In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulne
• CVE-2020-8495 HIGH 7.5 UPGRADE In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491d
• CVE-2020-8494 HIGH 8.8 UPGRADE In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402e
• CVE-2020-8493 MEDIUM 4.8 UPGRADE A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions befo
• CVE-2020-35604 CRITICAL 9.8 DOWNGRADE An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.
• CVE-2020-14982 MEDIUM 6.5 UPGRADE A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 (affecting the com.threeis.webt

FAQ

How do I fix web time and attendance vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is web time and attendance being exploited right now?

None of the tracked web time and attendance CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which web time and attendance CVE should I patch first?

CVE-2020-35604 currently ranks highest (63/100): An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used..

RSS feed for web time and attendance · ← Back to latest CVEs