570 matches found
Cross site scripting
In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable...
RISE Ultimate Project Manager Cross-Site Scripting Vulnerability
Rise Ultimate Project Manager is a web-based project management system, of which the My Profile section is a profile module. A cross-site scripting vulnerability exists in the input field of the My Profile section in Rise Ultimate Project Manager version 1.8. A remote attacker can use this...
CVE-2017-11181
Rise Ultimate Project Manager v1.8 contains a cross-site scripting (XSS) vulnerability in the Messaging section, specifically the Subject and Message fields. The CNVD entry indicates this can be exploited remotely by injecting arbitrary web script or HTML. No remediation details are provided in t...
CVE-2017-11182
In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable...
CVE-2017-11181
In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable...
CVE-2017-11182
Rise Ultimate Project Manager v1.8 contains cross-site scripting (XSS) vulnerabilities in the My Profile input fields. All input fields are vulnerable, enabling injection of arbitrary script/HTML. The CVE notes an XSS issue but does not provide exploitation status, impact depth beyond the stated ...
Rise Ultimate Project Manager 1.8 Cross Site Scripting
Exploit Title: Rise Ultimate Project Manager - Authenticated XSS Date: 2017-07-10 Exploit Author: 8bitsec Vendor Homepage: http://rise.fairsketch.com/ Software Link: https://codecanyon.net/item/rise-ultimate-project-manager/15455641 Version: 1.8 Tested on: Kali Linux 2.0 | Mac OS 10.12.5 Email:...
Harvest: Editing a project (LIMITED)
Hey there, I found out that invited user to a project cannot edit the project settings unless he is a PROJECT MANAGER on it. Now there is an option while editing project to make it BILLABLE OR NOT... When it is NOT billable it is quite impossible to BILL an invoice for it without making it...
Harvest: Project Manager can approve pending reports(Access control Issue)
Hi Team, Description : Project manager can't access the Pending approval section of Timesheet. So he should not be able to approve any reports of any user. But the approve report is working for project manager and he is able to approve reports of any user. Vulnerable HTTP request : POST...
Harvest: Extracting private info of estimates.
Hey there, So when someone creates a new estimate for a client it is not accessible to anyone except the admin and the person with the private URL of the web invoice. Now their is an option to convert estimate into invoice through https://amandhakertest.harvestapp.com/invoices/new?estimateid=IDHE...
Harvest: Unauthorized access to all the actions of invoices by PM (Access control Issues)
Hi Team, Description : Project ManagerFull access Can't access the projects and invoices which are not assigned to him.But this can be bypassed and following action Can be done by Any project manager : 1. Mark as send 2.Mark as draft 3.Mark as closed 4.Mark as open Any manager Can change above...
Harvest: Record payment for any invoice by PM (Access control Issue)
Hi Team, Description : Project ManagerFull access With Access to limited projects also have limited access to Invoices. So Project manager is assigned to limited project by Admin and he have access to limited Invoices related to assigned project. But Project manager can Actually Record payment of...
WordPress SP Project & Document Manager 2.5.3 SQL Injection
SQL Injection vulnerability in WordPress SP Project & Document Manager plugin pid parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...
CMS Made Simple 1.11.9 - Multiple Vulnerabilities
Vulnerabilities in CMS Made Simple, version 1.11.9 Discovered by Pedro Ribeiro [email protected] of Agile Information Security Reported to [email protected] and [email protected] Disclosure: 28/02/2014 / Last updated: 12/10/2014 CMS Made Simple, an open source content management...
traq 2.3.5 - Multiple Vulnerabilities
No description provided by source. ==================================================================== Vulnerable Software: traq-2.3.5 Official Site: TraqProject.org ==================================================================== About Software: Traq is a PHP powered project manager, capabl...
Traq Detection
The remote web server hosts Traq, a PHP-powered project manager used for tracking issues for multiple projects and milestones. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62891; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...
CVE-2010-5223
Multiple untrusted search path vulnerabilities in Phoenix Project Manager 2.1.0.8 allow local users to gain privileges via a Trojan horse 1 wbtrv32.dll or 2 w3btrv7.dll file in the current working directory, as demonstrated by a directory that contains a .ppx file. NOTE: some of these details are...
Design/Logic Flaw
Multiple untrusted search path vulnerabilities in Phoenix Project Manager 2.1.0.8 allow local users to gain privileges via a Trojan horse 1 wbtrv32.dll or 2 w3btrv7.dll file in the current working directory, as demonstrated by a directory that contains a .ppx file. NOTE: some of these details are...
CVE-2010-5223
Phoenix Project Manager 2.1.0.8 is affected by multiple untrusted search path vulnerabilities that allow local privilege escalation when a user places one of the DLLs (wbtrv32.dll or w3btrv7.dll) in the current working directory and opens a .ppx file. The issue relies on DLL search order in the p...
CVE-2010-5223
Multiple untrusted search path vulnerabilities in Phoenix Project Manager 2.1.0.8 allow local users to gain privileges via a Trojan horse 1 wbtrv32.dll or 2 w3btrv7.dll file in the current working directory, as demonstrated by a directory that contains a .ppx file. NOTE: some of these details are...