CVE-2021-3977

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross-site Scripting (XSS) - Reflected in yetiforcecompany/yetiforcecrm

Description Application is vulnerable to Reflected cross site scripting attack on create Invoice. Proof of Concept Step 1: Login into the application https://gitstable.yetiforce.com/index.php Step 2: Navigate to Quick Create - Cost Invoice Step 3: Click on Source and enter the XSS Playload in...

Cross-Site Request Forgery (CSRF)

kevinpapst/kimai2 is vulnerable to cross-site request forgery. The vulnerability exists in createInvoiceAction of InvoiceController.php which allows a malicious attacker to trick users to modify status of invoices and disrupt the tracking of invoices...

PHP Remote File Inclusion in crater-invoice/crater

Description No mime type restriction on file uploads, allowing an attacker to upload and execute arbitrary PHP code. Proof of Concept Login to the dashboard, preferably using your own localhost install. Go to "Expenses", "Settings Account" or "Settings Company". Upload any PHP file you want. Impa...

GHSA-GF2C-93HM-R9J5 Cross-site Scripting in kimai2

kimai2 is vulnerable to Cross-Site Request Forgery CSRF in deleting invoice templates. This vulnerability is capable of tricking admin user to delete invoice templates...

Cross-site Scripting in kimai2

kimai2 is vulnerable to Cross-Site Request Forgery CSRF in deleting invoice templates. This vulnerability is capable of tricking admin user to delete invoice templates...

Cross-Site Request Forgery (CSRF)

kevinpapst/kimai2 is vulnerable to cross-site request forgery. An attacker can delete invoice templates through the deleteCommentAction function in CustomerController.php...

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

CSRF Set 1 modify invoice status Medium severity Description CSRF in saving invoices / modifying status of invoices pending and cancel only Proof of Concept The following state-changing endpoints are vulnerable to CSRF GET...

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

Description CSRF in deleting invoice templates Proof of Concept CLICK ME! Impact This vulnerability is capable of tricking admin user to delete invoice templates...

CVE-2021-3380

Insecure direct object reference IDOR vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality...

CVE-2021-3380

Insecure direct object reference IDOR vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality...

Design/Logic Flaw

Insecure direct object reference IDOR vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality...

CVE-2021-3380

CVE-2021-3380 is an IDOR vulnerability in the ICREM H8 SSRMS Print Invoice functionality. The root cause is insecure direct object reference, allowing disclosure of sensitive information. The description is confirmed across multiple sources (NVD, RH, CVE list, CNNVD). No concrete patch/version re...

CVE-2021-3380

Insecure direct object reference IDOR vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality...

ICREM H8 SSRMS 安全漏洞

H8 Ssrms is a Canadian solution for the telecommunications industry. It is used to improve productivity, efficient processes, organized operations and increase profitability. A security vulnerability exists in ICREM H8 SSRMS that allows an attacker to disclose sensitive information through the...

CVE-2021-2482

Vulnerability in the Oracle Payables product of Oracle E-Business Suite component: Invoice Approvals. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful...

CVE-2021-2482

Vulnerability in the Oracle Payables product of Oracle E-Business Suite component: Invoice Approvals. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful...

Design/Logic Flaw

Vulnerability in the Oracle Payables product of Oracle E-Business Suite component: Invoice Approvals. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful...

CVE-2021-2482

CVE-2021-2482 affects Oracle E-Business Suite Payables, Invoice Approvals (versions 12.1.1–12.1.3). The Red Hat/NVD entries corroborate a vulnerability that can be exploited by a low-privilege, remote attacker over HTTP to compromise Oracle Payables, leading to unauthorized creation/deletion/modi...

CVE-2021-2482

Vulnerability in the Oracle Payables product of Oracle E-Business Suite component: Invoice Approvals. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful...