CVE-2020-13592

CVE-2020-13592 refers to an exploitable SQL injection in the Rukovoditel Project Management App 2.7.2, on the page global_lists/choices . The vulnerability arises from lack of input validation in the query that uses the lists_id parameter, allowing an attacker with an authenticated session to per...

CVE-2020-13587

CVE-2020-13587 affects Rukovoditel Project Management App 2.7.2, with an authenticated SQL injection in the forms_fields_rules/rules page. The root cause is an unsanitized id parameter used in a SQL query, enabling attackers with admin credentials or via CSRF to trigger the vulnerability. Impact ...

CVE-2020-13587

An exploitable SQL injection vulnerability exists in the "formsfieldsrules/rules" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done...

CVE-2020-13591

An exploitable SQL injection vulnerability exists in the "accessrules/rulesform" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done...

多款Indio Networks产品操作系统命令注入漏洞

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel Project Management App 2.7.2 suffers from a SQL injection vulnerability that can be trigger...

Rukovoditel Project Management App application SQL injection vulnerability in the 'global_lists/choices' page

Summary An exploitable SQL injection vulnerability exists in ‘globallists/choices’ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done...

Rukovoditel SQL注入漏洞

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel Project Management App 2.7.2 suffers from a SQL injection vulnerability that can be trigger...

Rukovoditel Project Management App application SQL injection vulnerability in the 'access_rules/rules_form' page

Summary An exploitable SQL injection vulnerability exists in the ‘‘accessrules/rulesform’ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be...

Rukovoditel Project Management App SQL injection vulnerability in the 'forms_fields_rules/rules' page

Summary An exploitable SQL injection vulnerability exists in the ‘formsfieldsrules/rules’ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be...

Rukovoditel SQL注入漏洞

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel Project Management App 2.7.2 suffers from a SQL injection vulnerability that can be trigger...

Rukovoditel Project Management App multiple SQL injection vulnerabilities in the 'entities/fields' page

Summary Multiple exploitable SQL injection vulnerabilities exist in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities, this can b...

Redmine Cross-Site Scripting Vulnerability (CNVD-2021-27365)

Redmine is an open source, web-based project management and defect tracking tool. A cross-site scripting vulnerability exists in Redmine. An attacker can exploit this vulnerability via the backurl field to conduct a cross-site scripting attack...

Information Leakage Vulnerability in Kingstone Engineering Project Management System

Dongying Jinshi Software Co., Ltd. is a dual-soft enterprise founded on the basis of China University of Petroleum, the company specializes in construction industry management software development. There is an information leakage vulnerability in Jinshi Project Management System. An attacker can...

Information Disclosure Vulnerability in Jinshi Engineering Project Management System (CNVD-2021-28383)

Dongying Jinshi Software Co., Ltd. is a dual-soft enterprise founded on the basis of China University of Petroleum, the company specializes in construction industry management software development. There is an information leakage vulnerability in Jinshi Project Management System. An attacker can...

Kanboard has a weak password vulnerability

Kanboard is a free open source Kanban project management software. Kanboard has a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

Logic flaw vulnerability in oasys

oasys is an OA office automation system , the use of Maven for project management , springboot framework based on the development of the project , mysql underlying database , the front-end freemarker template engine , Bootstrap as the front-end UI framework , integrated jpa, mybatis and other...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2021-14399)

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT 2.24.3 and earlier versions, which stems from a custom field name n...

GitLab: Guest users can create new test cases

Summary According to the permission docs and test case docs , only user with a role Reporter or more is allowed to create a test case. This vulnerability allows, even Guest role users to create new test cases. Steps to reproduce 1. Consider a private project with Guest role user. 2. Consider the...

Directory Traversal Vulnerability in Jinshi Project Management Software of Dongying Jinshi Software Co.

Jinshi project management software is Jinshi software company to many construction enterprise management status quo as the starting point to create an information technology internal control management platform. There is a directory traversal vulnerability in Dongying Jinshi Software Company...

Unspecified Vulnerability in JetBrains YouTrack (CNVD-2021-09914)

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in JetBrains YouTrack before 2020.6.1767, which stems from a...