36171 matches found
GHSA-C6W6-57JJ-62VH Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
Summary Kimai 2.56.0 contains an authenticated authorization bypass in the timesheet restart and duplicate workflows. After a user loses access to a project, the user can still derive a new timesheet from one of their historical entries and create a new record under that now-unauthorized project...
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
Summary Kimai 2.56.0 contains an authenticated authorization bypass in the timesheet restart and duplicate workflows. After a user loses access to a project, the user can still derive a new timesheet from one of their historical entries and create a new record under that now-unauthorized project...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the activity creation process when a user with the createactivity permission accesses the preset project creation route directly. An attacker can create new activities under unauthorized projects by specifying ...
GHSA-3Q6Q-26VG-V97X Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic createactivity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...
Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic createactivity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...
PT-2026-60088
Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic create activity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...
PT-2026-58937
Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the Web rate editing flows for projects, customers, and activities. A user who can edit one authorized parent object can combine that authorized parent ID with the rate ID of a different, unauthorized parent...
PT-2026-58828
An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function...
CVE-2026-44769: Improper Neutralization of Special Elements used in an SQL Command
SAP S/4HANA application Project Management PPM-PRO allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application...
CVE-2026-9108: Improper Limitation of a Pathname to a Restricted Directory
A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal...
PT-2026-58940
Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic create activity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...
CVE-2026-38450
An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function...
CVE-2026-51105
Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OPSERVERMESSAGE Handler...
PT-2026-58018
Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.3 Description Improper authorization occurs during job information retrieval, allowing an attacker to gain access to unauthorized jobs belonging to other projects. Recommendations Upgrade to version 5.0.4...
PT-2026-58081
A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal...
EUVD-2026-43685
Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OPSERVERMESSAGE Handler...
PT-2026-57945
SAP S/4HANA application Project Management PPM-PRO allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application...
PT-2026-58003
A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced All versions. Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This could allow an unauthenticated attacker on the local networ...
PT-2026-60093
Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the Web rate editing flows for projects, customers, and activities. A user who can edit one authorized parent object can combine that authorized parent ID with the rate ID of a different, unauthorized parent...
