BIT-OPENPROJECT-2023-33960

OpenProject is web-based project management software. For any OpenProject installation, a robots.txt file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in the authentication process, which allows a malicious individual to alter the settings of the user interface for project management.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to modify the settings of the user interface for project...

taskhub 2.8.7 - SQL Injection Vulnerability

Exploit Title: taskhub 2.8.7 - SQL Injection Exploit Author: CraCkEr Vendor: Infinitie Technologies Vendor Homepage: https://www.infinitietech.com/ Software Link: https://codecanyon.net/item/taskhub-project-management-finance-crm-tool/25685874 Demo: https://taskhub.company/auth Tested on: Windows...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project...

CVE-2023-46773

Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation...

Nature Easy Soft Network Technology ZenTao Cross-Site Scripting Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management and other...

CVE-2023-47544

Unauth. Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.12 versions...

CVE-2023-47544 WordPress Atarim Plugin <= 3.12 is vulnerable to Cross Site Scripting (XSS)

Unauth. Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.12 versions...

CVE-2023-47544

CVE-2023-47544: Unauthenticated Stored XSS in Atarim Visual Website Collaboration plugin ≤ 3.12. An attacker could inject scripts that run in other users’ contexts. Patch is available in version 3.13; upgrade to remediation. Public references confirm the vulnerability and version cap.

PentestPad: Platform for Pentest Teams

In the ever-evolving cybersecurity landscape, the game-changers are those who adapt and innovate swiftly. Pen test solutions not only supercharge productivity but also provide a crucial layer of objectivity, ensuring efficiency and exceptional accuracy. The synergy between a skilled penetration...

Nature Easy Soft Network Technology ZenTao Information Disclosure Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management functions. ...

CVE-2023-45826

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

Sql injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

CVE-2023-45826 Authenticated SQL Injection in leantime

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

CVE-2023-45826

Leantime (open source project management system) contains an authenticated SQL injection in the files API. The root cause is an unparameterized 'userId' variable in app/domain/files/repositories/class.files.php, exploitable by sending crafted POST requests to /api/jsonrpc. Impact is confidentiali...

qdPM Path Traversal Vulnerability

qdPM is a web-based open source project management tool. A security vulnerability exists in qdPM version 9.2 that stems from the presence of a directory traversal vulnerability. Allows an attacker to list files and directories by navigating to the /uploads URI...

Dependabot impersonators cause trouble on GitHub

GitHub is experiencing issues of the "breached account and malicious code" variety. ITPro reports that unnamed individuals have been compromising accounts and using them to install malware capable of password theft. Its a fairly elaborate scam which even includes imitation of GitHubs popular...

The vulnerability in the Redmine project and task management web application relates to the lack of security measures for the website structure, allowing an attacker to carry out XSS attacks.

The vulnerability in the Redmine project and task management web application relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2023-37393

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.9.3 versions...

CVE-2023-37393

CVE-2023-37393 is a stored XSS vulnerability in the WordPress plugin Atarim Visual Website Collaboration, Feedback & Project Management – Atarim (versions 3.9.3 (Patchstack notes fixed in 3.9.4). If upgrading is not immediately possible, apply mitigations per vendor guidance and monitor for upda...