RHEL 8 : Red Hat OpenStack Platform 16.1.9 (openstack-nova) (RHSA-2024:5113)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5113 advisory. OpenStack Compute codename Nova is open source software designed to provision and manage large networks of virtual machines,creating a redundant and...

The vulnerability of the JetBrains YouTrack project management and task management software, related to the absence of an authentication process that allows unauthorized users to elevate their privileges.

The vulnerability of the JetBrains YouTrack project management and task management software is related to the absence of an authentication process. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...

PT-2024-7488 · Yougile · Yougile

Name of the Vulnerable Software and Affected Versions: YouGile affected versions not specified Description: The issue is related to insufficient protection of service data in the project management service. It may allow a remote attacker to disclose protected information. Recommendations: At the...

PT-2024-7491

Name of the Vulnerable Software and Affected Versions: YouGile affected versions not specified Description: The issue is related to insufficient protection of service data in the project management service. It may allow a remote attacker to disclose protected information. Recommendations: At the...

PT-2024-7490

Name of the Vulnerable Software and Affected Versions: YouGile affected versions not specified Description: The issue is related to a lack of restrictions on file uploads in the project management service. This could allow a remote attacker to execute arbitrary code. Recommendations: At the momen...

PT-2024-7489

Name of the Vulnerable Software and Affected Versions: YouGile affected versions not specified Description: The issue is related to incorrect handling of logical operations in the project management service. This allows a remote attacker to exploit the issue and elevate their privileges...

JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a project management tool that supports cloud hosting and local deployment, and is primarily geared towards team collaboration management, especially suitable for software development, human resources, marketing, and other scenarios. JetBrains YouTrack suffers from a securit...

Animated AL List <= 1.0.6 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin 1. Add a new project 2. Access the URL...

CVE-2024-36399

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser. The users permission to add users to a project only get checked on the URL parameter projectid. If the user is authorized to add users to...

CVE-2024-36399 Kanboard affected by Project Takeover via IDOR in ProjectPermissionController

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser. The users permission to add users to a project only get checked on the URL parameter projectid. If the user is authorized to add users to...

CVE-2024-36399

Summary: CVE-2024-36399 affects Kanboard prior to 1.2.37. The flaw is in app/Controller/ProjectPermissionController.php, function addUser(), where a user’s permission to add project members is only checked via the URL parameter project_id. The POST body’s project_id is not re-validated during pro...

CVE-2024-36399

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser. The users permission to add users to a project only get checked on the URL parameter projectid. If the user is authorized to add users to...

kanboard -- Project Takeover via IDOR in ProjectPermissionController

[email protected] reports: Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser. The users permission to add users to a project only get checked on the URL parameter projectid. I...

CVE-2024-2038 Visual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded Credentials

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.22.6. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible fo...

CVE-2024-2038: Use of Hard-coded Password

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.22.6. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible fo...

WordPress SP Project & Document Manager Plugin <= 4.70 is vulnerable to Directory Traversal

Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.70 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Directory Traversal CVE CVE-2024-1693 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f84eca5d6c78 Credits fewwords huang Requir...

Leantime Systems Leantime 安全漏洞

Leantime Systems Leantime is an open source PHP and MySQL based project management system from Leantime Systems, Inc. A security vulnerability exists in Leantime Systems Leantime version 3.0.6 that stems from vulnerability to HTML injection attacks...

GNU Savane Insecure Direct Object Reference Vulnerability

GNU Savane is a collaborative software development management system for project management, code hosting and community collaboration. GNU Savane suffers from an insecure direct object reference vulnerability that arises from an application that does not properly implement access control mechanis...

[SECURITY] Fedora 40 Update: apache-ivy-2.5.2-4.fc40

Apache Ivy is a tool for managing recording, tracking, resolving and reporting project dependencies. It is designed as process agnostic and is not tied to any methodology or structure. while available as a standalone tool, Apache Ivy works particularly well with Apache Ant providing a number of...

BIT-OPENPROJECT-2021-43830

OpenProject is a web-based project management software. OpenProject versions = 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in...