GHSA-VRR2-G9GH-C3JC Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Summary The Timesheet API PATCH /api/timesheets/id and POST /api/timesheets endpoints accept a user-supplied project ID and resolve it through a Symfony EntityType whose querybuilder allows the submitted ID to satisfy the access predicate via an unconditional OR branch. As a result, any...

Linux Distros Unpatched Vulnerability : CVE-2022-38183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any...