Harvest: Editing a project (LIMITED)

Hey there, I found out that invited user to a project cannot edit the project settings unless he is a PROJECT MANAGER on it. Now there is an option while editing project to make it BILLABLE OR NOT... When it is NOT billable it is quite impossible to BILL an invoice for it without making it...

Harvest: Linking Invoice to uninvited project.

Hey there, I found that an project manager can link his/her invoice to an project where he/she is uninvited. While linking the invoice an request is sent : POST /invoices/10877569 HTTP/1.1 Host: hshteam.harvestapp.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:49.0 Gecko/20100101...

Threat Outbreak Alert RuleID25326: Email Messages Distributing Malicious Software on October 6, 2016

Medium Alert ID: 49208 First Published: 2016 October 6 14:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID25326 may contain the following files: Name |...

Threat Outbreak Alert RuleID25298: Email Messages Distributing Malicious Software on October 6, 2016

Medium Alert ID: 49205 First Published: 2016 October 6 14:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID25298 may contain the following files: Name |...

Threat Outbreak Alert RuleID25304: Email Messages Distributing Malicious Software on September 28, 2016

Medium Alert ID: 49064 First Published: 2016 September 28 15:30 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID25304 may contain the following files: Name ...

Threat Outbreak Alert RuleID25017: Email Messages Distributing Malicious Software on September 13, 2016

Medium Alert ID: 48915 First Published: 2016 September 15 21:28 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID25017 may contain the following files: Name ...

[SECURITY] Fedora 25 Update: trytond-account-invoice-4.0.2-1.fc25

account-invoice module for Tryton application server...

Threat Outbreak Alert RuleID24969: Email Messages Distributing Malicious Software on September 11, 2016

Medium Alert ID: 48835 First Published: 2016 September 12 13:40 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24969 may contain the following files: Name ...

Threat Outbreak Alert RuleID24881: Email Messages Distributing Malicious Software on September 7, 2016

Medium Alert ID: 48799 First Published: 2016 September 7 13:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24881 may contain the following files: Name |...

Threat Outbreak Alert RuleID24785: Email Messages Distributing Malicious Software on September 4, 2016

Medium Alert ID: 48764 First Published: 2016 September 6 14:01 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24785 may contain the following files: Name |...

Harvest: Extracting private info of estimates.

Hey there, So when someone creates a new estimate for a client it is not accessible to anyone except the admin and the person with the private URL of the web invoice. Now their is an option to convert estimate into invoice through https://amandhakertest.harvestapp.com/invoices/new?estimateid=IDHE...

Harvest: Unauthorized read access to Invoices by PM (Access control Issues)

Hi Team, Description : Project Manager have access to limited projects and corresponding Invoices. But he can view any private Invoices of the company which he doesn't have access to. Sending Invoice Request is Vulnerable to Indirect Object Reference Attack. Any Unprivileged Project manager can...

Harvest: Record payment for any invoice by PM (Access control Issue)

Hi Team, Description : Project ManagerFull access With Access to limited projects also have limited access to Invoices. So Project manager is assigned to limited project by Admin and he have access to limited Invoices related to assigned project. But Project manager can Actually Record payment of...

Threat Outbreak Alert RuleID24005: Email Messages Distributing Malicious Software on July 27, 2016

Medium Alert ID: 48260 First Published: 2016 July 27 13:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24005 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID23914: Email Messages Distributing Malicious Software on July 21, 2016

Medium Alert ID: 47179 First Published: 2016 July 21 14:07 GMT Last Updated: 2016 July 21 15:34 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23914 and...

Design/Logic Flaw

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the Oracle Healthcare Maste...

CVE-2016-0635

The connected Nessus/NASL records tie CVE-2016-0635 to the Oracle Siebel CRM knowledge component (AnswerFlow Spring Framework) in Siebel CRM. Affected versions are 8.5.1.0–8.5.1.7 and 8.6.0. The vulnerability in the Oracle Knowledge component can be exploited remotely over HTTP by a low-privilege...

CVE-2016-0635

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the Oracle Healthcare Maste...

Harvest: Stored XSS on invoice, executing on any subdomain

Summary ----------- There is a stored XSS vulnerability, which can execute on any subdomain as the vulnerability lies in an invoice. You are filtering HTML and js, but you neglect to filter out Flash objects, which can execute javascript. Steps to reproduce ------------- 1. Create an invoice and...

Threat Outbreak Alert RuleID23765: Email Messages Distributing Malicious Software on July 6, 2016

Medium Alert ID: 47011 First Published: 2016 July 6 18:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23765 may contain the following files: Name | Size...