175 matches found
CVE-2024-29200
Kimai is a web-based multi-user time-tracking application. The permission viewothertimesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the viewothertimesheet permission to true, on the frontend, users can only see timesheet...
CVE-2024-29200
Kimai API flaw CVE-2024-29200 exposes timesheet entries to users who should be restricted. The issue stems from inconsistent handling of the view_other_timesheet permission between the UI and API, where the UI restricts data to a user’s teams but the API returns all timesheets when querying /api/...
BIT-GITLAB-2020-13319
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue...
CVE-2023-46245
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the...
Remote code execution
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the...
CVE-2023-46245 Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the...
CVE-2023-46245 Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the...
CVE-2023-46245
Kimai 2.x prior to 2.1.0 is vulnerable to Server-Side Template Injection (SSTI) via uploaded Twig templates, which can be escalated to Remote Code Execution (RCE) when rendering PDFs/HTML invoices. Proof-of-concept payloads upload a Twig file and trigger rendering to execute arbitrary commands on...
Traggo Server 路径遍历漏洞
Traggo is a tag-based time tracking tool. A directory traversal vulnerability exists in the Traggo server, which can be exploited by an attacker to read arbitrary files...
CVE-2023-32308
The CVE-2023-32308 entry concerns anuko timetracker, an open-source time-tracking system. A Boolean-based blind SQL injection existed in Time Tracker’s invoices.php for versions prior to 1.22.11.5781, caused by a coding error after validating POST parameters and lack of an error check before adju...
Crlf injection
Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the reports.php page was not validating all parameters in POST requests. Because some parameters were not...
CVE-2023-32306
Time Tracker vulnerability CVE-2023-32306 exists in the Reports feature (reports.php) of Time Tracker prior to version 1.22.13.5792. A time-based blind SQL injection arises because several POST parameters aren’t properly validated, enabling crafted requests to inject SQL into the Time Tracker dat...
CVE-2023-32066
Time Tracker’s Week View plugin (versions setTitle call in week.php (line ~245) as implemented in 1.22.12.5783. Affected products include Anuko Time Tracker; no exploitation status is provided in the documents. Recommended remediation: upgrade to 1.22.12.5783 or newer to mitigate the vulnerabilit...
UBUNTU-CVE-2022-30699
NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached delegation information is about to expire. The rogue...
Fedora: Security Advisory for git-time-metric (FEDORA-2022-5ef0bd9a27)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 36 Update: git-time-metric-1.3.5-16.fc36
Simple, seamless, lightweight time tracking for Git...
mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exectimetracker::getloops/Filesorttracker::reportuse/filesort...
[SECURITY] Fedora 36 Update: git-time-metric-1.3.5-15.fc36
Simple, seamless, lightweight time tracking for Git...
titra 跨站脚本漏洞
titra is a modern open source time tracking project for freelancers and small teams. A cross-site scripting vulnerability exists in versions prior to titra 0.77.0, which stems from the presence of stored cross-site scripting XSS...