7 matches found
CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility
Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...
CVE-2026-52825
Kimai , an open-source time tracking application, contains an improper authorization flaw in its Team assignment APIs. Prior to 2.58.0 , the endpoints POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} verified only that a Teamlead could edit the team, without ...
EUVD-2005-1070
Malware in sbrugna...
CVE-2005-1067
Vulnerability in Accessuser Class before 1.75 allows local users to gain access as other users via the password "new"...
CVE-2005-1067
CVE-2005-1067 describes a local privilege escalation in the Access_user Class prior to version 1.75, where an attacker can gain access as another user using the password “new.” The connected documents confirm this vulnerability but do not provide vendor/product specifics, affected versions beyond...
