CVE-2022-24708

The CVE-2022-24708 entry describes a Stored XSS vulnerability in Anuko Time Tracker. The issue occurs in ttUser.class.php where the primary group name was not escaped for display, allowing a logged-in user to inject JavaScript that could execute in their browser on pages displaying the group name...

kimai2 cross-site scripting vulnerability (CNVD-2021-94816)

kimai2 is an open source, web-based multi-user time tracking application. kimai2 suffers from a cross-site scripting vulnerability that can be exploited by attackers to perform cross-site scripting attacks...

kimai2 cross-site scripting vulnerability

kimai2 is an open source, web-based multi-user time tracking application. kimai2 suffers from a cross-site scripting vulnerability, for which no details of the vulnerability are currently available...

kimai 跨站脚本漏洞

kimai2 is an open source, web-based multi-user time tracking application. kimai2 suffers from a cross-site scripting vulnerability that can be exploited by attackers to perform cross-site scripting attacks...

Kimai 访问控制错误漏洞

kimai2 is an open source, web-based multi-user time tracking application. kimai2 is vulnerable to an access control error, and no details of the vulnerability are currently available...

kimai 跨站脚本漏洞

kimai2 is an open source, web-based multi-user time tracking application. kimai2 suffers from a cross-site scripting vulnerability, for which no details of the vulnerability are currently available...

kimai cross-site request forgery vulnerability

Kimai is an open source, web-based multi-user time tracking application. kimai 2 1.16.2 previously contained a cross-site request forgery vulnerability, which stems from the product's failure to verify that requests originate from trusted users. An attacker could send an unintended request to the...

Kimai 跨站请求伪造漏洞

Kimai is an open source, web-based, multi-user time tracking application. A cross-site request forgery vulnerability exists in Kimai 2, which stems from the product's failure to validate that a request originated from a trusted user. An attacker could use this vulnerability to send unintended...

Kimai 跨站请求伪造漏洞

Kimai is an open source, web-based, multi-user time tracking application. A cross-site request forgery vulnerability exists in Kimai 2, which stems from the product's failure to validate that a request originated from a trusted user. An attacker could use this vulnerability to send unintended...

Kimai 跨站请求伪造漏洞

Kimai is an open source, web-based multi-user time tracking application. kimai 2 1.16.2 previously contained a cross-site request forgery vulnerability, which stems from the product's failure to verify that requests originate from trusted users. An attacker could send an unintended request to the...

Cross-site Scripting (XSS) - Stored in eventum/eventum

Description Multiple Stored XSS in Administration at eventum 3.10.8 Proof of Concept // PoC.payload " Step to Reproduct Goto Administration Areas and choose to feature below Manage News Input payload into fieldTitle Manage Status Input payload into fieldTitle Manage Projects Input payload into...

CVE-2021-41156 Reflected XSS vulnerability

anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browsertoday hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craf...

CVE-2021-41139

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions prior to 1.19.30.5600, it was possible...

CVE-2021-41139

Anuko Time Tracker (PHP) suffers a reflected XSS in time.php via the date URI parameter, exploitable before patch in 1.19.30.5600. An attacker could persuade a logged-in user to click a crafted link, causing attacker-supplied JavaScript to execute in the user’s browser. Remediated in version 1.19...

CISA Alert: Top Routinely Exploited Vulnerabilities

On July 28, 2021, the U.S. Cybersecurity and Infrastructure Security Agency CISA released a cybersecurity advisory detailing the top 30 publicly known vulnerabilities that have been routinely exploited by cyber threat actors in 2020 and 2021. Organizations are advised to prioritize and apply...

Tracking Amazon delivery staff

TL; DR The Amazon delivery tracking API allows ultra-precise tracking of drivers. Amazon claim that customers can only track the driver for the 10 stops prior to theirs. This isn’t the case – one can track the driver on the entire route and all drops, including their speed on the road. This preci...

Cross site request forgery (csrf)

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery CSRF vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an...

CVE-2021-29436 Cross site request forgery vulnerability

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery CSRF vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an...

CVE-2021-21352

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess...

CVE-2021-21352

Anuko Time Tracker (PHP) before version 1.19.24.5415 uses time-based tokens in the password-reset feature, enabling brute-force guessing to change user passwords (including admin). The issue is addressed in 1.19.24.5415 (better tokens) and further limited in 1.19.24.5416 with a reduced brute-forc...