Nature Easy Soft Network Technology ZenTao Cross-Site Scripting Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management and other...

CVE-2023-47544

Unauth. Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.12 versions...

CVE-2023-47544 WordPress Atarim Plugin <= 3.12 is vulnerable to Cross Site Scripting (XSS)

Unauth. Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.12 versions...

CVE-2023-47544

CVE-2023-47544: Unauthenticated Stored XSS in Atarim Visual Website Collaboration plugin ≤ 3.12. An attacker could inject scripts that run in other users’ contexts. Patch is available in version 3.13; upgrade to remediation. Public references confirm the vulnerability and version cap.

PentestPad: Platform for Pentest Teams

In the ever-evolving cybersecurity landscape, the game-changers are those who adapt and innovate swiftly. Pen test solutions not only supercharge productivity but also provide a crucial layer of objectivity, ensuring efficiency and exceptional accuracy. The synergy between a skilled penetration...

Nature Easy Soft Network Technology ZenTao Information Disclosure Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management functions. ...

CVE-2023-45826

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

Sql injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

CVE-2023-45826

Leantime (open source project management system) contains an authenticated SQL injection in the files API. The root cause is an unparameterized 'userId' variable in app/domain/files/repositories/class.files.php, exploitable by sending crafted POST requests to /api/jsonrpc. Impact is confidentiali...

CVE-2023-45826 Authenticated SQL Injection in leantime

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

qdPM Path Traversal Vulnerability

qdPM is a web-based open source project management tool. A security vulnerability exists in qdPM version 9.2 that stems from the presence of a directory traversal vulnerability. Allows an attacker to list files and directories by navigating to the /uploads URI...

Dependabot impersonators cause trouble on GitHub

GitHub is experiencing issues of the "breached account and malicious code" variety. ITPro reports that unnamed individuals have been compromising accounts and using them to install malware capable of password theft. Its a fairly elaborate scam which even includes imitation of GitHubs popular...

The vulnerability in the Redmine project and task management web application relates to the lack of security measures for the website structure, allowing an attacker to carry out XSS attacks.

The vulnerability in the Redmine project and task management web application relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2023-37393

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.9.3 versions...

CVE-2023-37393

CVE-2023-37393 is a stored XSS vulnerability in the WordPress plugin Atarim Visual Website Collaboration, Feedback & Project Management – Atarim (versions 3.9.3 (Patchstack notes fixed in 3.9.4). If upgrading is not immediately possible, apply mitigations per vendor guidance and monitor for upda...

CVE-2023-37393 WordPress Atarim Plugin <= 3.9.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.9.3 versions...

Microsoft Dynamics Business Central Elevation of Privilege Vulnerability

Microsoft Dynamics Business Central is an enterprise resource planning system from Microsoft. The system includes features such as financial management, project management and supply chain management. An elevation of privilege vulnerability exists in Microsoft Dynamics Business Central, which can...

ProjeQtOr Project Management System v10.4.1 - Multiple XSS Vulnerabilities

Exploit Title: ProjeQtOr Project Management System V10.4.1 - Multiple XSS Version: V10.4.1 Bugs: Multiple XSS Technology: PHP Vendor URL: https://www.projeqtor.org Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV10.4.1.zip/download Date of found: 09.07.2023 Author:...

ProjeQtOr Project Management System v10.4.1 - Multiple XSS

Exploit Title: ProjeQtOr Project Management System V10.4.1 - Multiple XSS Version: V10.4.1 Bugs: Multiple XSS Technology: PHP Vendor URL: https://www.projeqtor.org Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV10.4.1.zip/download Date of found: 09.07.2023 Author:...

CVE-2023-36813

Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly...