Rukovoditel SQL注入漏洞

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel Project Management App 2.7.2 suffers from a SQL injection vulnerability that can be trigger...

Rukovoditel Project Management App application SQL injection vulnerability in the 'access_rules/rules_form' page

Summary An exploitable SQL injection vulnerability exists in the ‘‘accessrules/rulesform’ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be...

Rukovoditel Project Management App SQL injection vulnerability in the 'forms_fields_rules/rules' page

Summary An exploitable SQL injection vulnerability exists in the ‘formsfieldsrules/rules’ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be...

Rukovoditel Project Management App multiple SQL injection vulnerabilities in the 'entities/fields' page

Summary Multiple exploitable SQL injection vulnerabilities exist in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities, this can b...

Rukovoditel SQL注入漏洞

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel Project Management App 2.7.2 suffers from a SQL injection vulnerability that can be trigger...

Rukovoditel Project Management App application SQL injection vulnerability in the 'global_lists/choices' page

Summary An exploitable SQL injection vulnerability exists in ‘globallists/choices’ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done...

Redmine Cross-Site Scripting Vulnerability (CNVD-2021-27365)

Redmine is an open source, web-based project management and defect tracking tool. A cross-site scripting vulnerability exists in Redmine. An attacker can exploit this vulnerability via the backurl field to conduct a cross-site scripting attack...

Information Disclosure Vulnerability in Jinshi Engineering Project Management System (CNVD-2021-28383)

Dongying Jinshi Software Co., Ltd. is a dual-soft enterprise founded on the basis of China University of Petroleum, the company specializes in construction industry management software development. There is an information leakage vulnerability in Jinshi Project Management System. An attacker can...

Information Leakage Vulnerability in Kingstone Engineering Project Management System

Dongying Jinshi Software Co., Ltd. is a dual-soft enterprise founded on the basis of China University of Petroleum, the company specializes in construction industry management software development. There is an information leakage vulnerability in Jinshi Project Management System. An attacker can...

Kanboard has a weak password vulnerability

Kanboard is a free open source Kanban project management software. Kanboard has a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

Logic flaw vulnerability in oasys

oasys is an OA office automation system , the use of Maven for project management , springboot framework based on the development of the project , mysql underlying database , the front-end freemarker template engine , Bootstrap as the front-end UI framework , integrated jpa, mybatis and other...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2021-14399)

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT 2.24.3 and earlier versions, which stems from a custom field name n...

GitLab: Guest users can create new test cases

Summary According to the permission docs and test case docs , only user with a role Reporter or more is allowed to create a test case. This vulnerability allows, even Guest role users to create new test cases. Steps to reproduce 1. Consider a private project with Guest role user. 2. Consider the...

Directory Traversal Vulnerability in Jinshi Project Management Software of Dongying Jinshi Software Co.

Jinshi project management software is Jinshi software company to many construction enterprise management status quo as the starting point to create an information technology internal control management platform. There is a directory traversal vulnerability in Dongying Jinshi Software Company...

Unspecified Vulnerability in JetBrains YouTrack (CNVD-2021-09914)

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in JetBrains YouTrack before 2020.6.1767, which stems from a...

MantisBT Information Disclosure Vulnerability (CNVD-2021-09043)

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT versions prior to 2.24.4, which stems from a lack of access checkin...

MSPs, have you picked the right PSA for you yet?

Not long ago, we helped MSPs pick the right remote monitoring and management RMM platform for them, and make it an essential part of their service toolkit. As you may recall, an RMM is a tool that helps MSPs do the work. And what better way to track the work—and other elements associated with...

Unauthorized Access Vulnerability in Zendo Project Management Software

Zendo Project Management Software is homegrown open source project management software. Zendo Project Management Software has an unauthorized access vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information and perform unauthorized operations...

SQL Injection Vulnerability in oasys Frontend

oasys is an OA office automation system , the use of Maven for project management , springboot framework based on the development of the project , mysql underlying database , front-end freemarker template engine , Bootstrap as the front-end UI framework , integrated jpa, mybatis and other...

Worktile is vulnerable to XSS

Worktile is an enterprise collaboration platform that solves the collaboration, office and management pain points of companies of 30-1,000 people, helping companies implement project management, standardize processes, build knowledge bases, and assist management decisions. Worktile has an XSS...