PatchTheCVEkronos vulnerabilities
Recent CVEs affecting kronos products. 6 tracked.
kronos has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2020-12-21. Highest priority: CVE-2020-35604 (score 63/100).
- CVE-2020-8496 MEDIUM 4.8 UPGRADE In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulne
- CVE-2020-8495 HIGH 7.5 UPGRADE In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491d
- CVE-2020-8494 HIGH 8.8 UPGRADE In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402e
- CVE-2020-8493 MEDIUM 4.8 UPGRADE A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions befo
- CVE-2020-35604 CRITICAL 9.8 DOWNGRADE An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.
- CVE-2020-14982 MEDIUM 6.5 UPGRADE A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 (affecting the com.threeis.webt
FAQ
How do I fix kronos vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is kronos being exploited right now?
None of the tracked kronos CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which kronos CVE should I patch first?
CVE-2020-35604 currently ranks highest (63/100): An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used..