timetracker

5 results · Clear filters · Feed

• Medium 5.4
  CVE-2023-32066

  Time Tracker has Stored XSS vulnerability in Week View plugin

  Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements …

  anuko timetracker
  May 9, 2023
• Medium 6.5
  CVE-2022-24708

  Stored XSS vulnerability in anuko/timetracker

  Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to …

  anuko timetracker
  Feb 23, 2022
• Medium 6.8
  CVE-2021-41156

  Reflected XSS vulnerability

  anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior t…

  anuko timetracker
  Oct 18, 2021
• Medium 5.4
  CVE-2021-29436

  Cross site request forgery vulnerability

  Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by soci…

  anuko timetracker
  Apr 13, 2021
• Medium 6.8
  CVE-2021-21352

  Predictable tokens used for password resets

  Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a w…

  anuko timetracker
  Mar 3, 2021