Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

Summary GET /api/timesheets?user= and users= returns the targeted user's timesheet records to any caller that has the viewothertimesheet permission, without verifying that the caller is teamlead of any team containing the target user. The per-record endpoint GET /api/timesheets/id correctly...

CVE-2017-18581

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list...

EUVD-2017-9697

Malware in sbrugna...

CVE-2017-18581

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list...

CVE-2017-18581

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list...

CVE-2017-18581: Improper Neutralization of Input During Web Page Generation

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list...

PT-2019-8515

Name of the Vulnerable Software and Affected Versions WordPress time-sheets plugin versions prior to 1.5.0 Description The issue concerns a Cross-Site Scripting XSS problem. It is related to the old timesheet list in the time-sheets plugin for WordPress. Recommendations For versions prior to 1.5....