CVE-2008-1415: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Multiple Time Sheets MTS 5.0 and earlier allows remote attackers to read arbitrary files via "../..//" modified dot dot sequences in the tab parameter...

CVE-2008-1414: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Multiple Time Sheets MTS 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the tab parameter to 1 index.php, as demonstrated using mixed case and encoded whitespace characters in the tag; or 2 clientinfo.php, 3 invoices.ph...