Visma Public: Information disclosure to "Permission as auditor" user

Inside the same company, the researcher was able to view information that that was not supposed to with the Auditor role associated with the user...

Visma Public: A sales only user can edit the purchase invoice drafts.

The researcher has found a missing authorization issue: a sales only user could edit the purchase invoice drafts that he shouldn't...

Visma Public: Reverse Tabnabbing in printing source document images

The security researcher was able to find a Reverse Tabnabbing bug in printing source document images functionality. This bug allows to replace current web page in users browser with a phishing one, facilitating phishing attacks...

Visma Public: [CSRF]While Closing and opening Fiscal year.

The reporter has found that the CSRF token is not checked when using the Open/Close functionality of the Fiscal year...

Visma Public: Read-only user can access payroll information without having access to payroll.

The researcher found that a read-only user without having access to payroll can still access all the data in payroll tab, by visiting the url directly, thus resulting into an unauthorized access...

Visma Public: Access control on https://eaccounting.stage.vismaonline.com/

The researcher was able to find an access control issue in the application by checking if the permissions are correctly replicated in the active sessions for the user...

Visma Public: Able to continue user creation process after deleting the HTML element that shows the message that the session is closed

Summary: Able to continue user creation process and successfully submit the user creation form after deleting the HTML element that shows the message that the session is closed after signing out in different tab from same browser. Steps To Reproduce: 1. Login to...

Visma Public: Arbitrary File Upload to Stored XSS

An attacker is able to bypass the restrictions which limit user uploads to .PDF only. Utilizing this exploit by changing the content Beacon.html%00.pdf an attacker can upload malicious content to the web server and an included JavaScript code to gain Stored XSS...

Visma Public: Session replay vulnerability in app.workbox.dk domain

The researcher found that sessions don't expire when users logs out of their account. This means that if the session cookie and it's value is known, an attacker can impersonate the owner of the account...