CVE-2020-8494

In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the emp_id, userid, pw1, pw2, supervisor, and timekeeper parameters.

• http://www.nolanbkennedy.com/post/privilege-escalation-2-in-kronos-web-time-and-attendance-webtaExploit, Third Party Advisory
• https://www.kronos.com/products/kronos-webtaProduct, Vendor Advisory
• http://www.nolanbkennedy.com/post/privilege-escalation-2-in-kronos-web-time-and-attendance-webtaExploit, Third Party Advisory
• https://www.kronos.com/products/kronos-webtaProduct, Vendor Advisory

Published

Jan 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8486Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8487Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8488Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8489Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8492Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.…6.5
• CVE-2020-8493A stored XSS vulnerability in Kronos Web Time and Attendance…4.8
• CVE-2020-8495In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.…7.5
• CVE-2020-8496In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.…4.8
• CVE-2020-8497In Artica Pandora FMS through 7.42, an unauthenticated attac…5.3
• CVE-2020-8498XSS exists in the shortcode functionality of the GistPress p…5.4
• CVE-2020-8500In Artica Pandora FMS 7.42, Web Admin users can execute arbi…7.2
• CVE-2020-8503Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 …6.5