Vulnerabilities

Filters

2 selected

12 records

Sort

Vendor: anuko Component: Time Tracker Clear all filters

TI-2023-15602 CVE-2023-32308

SQL Injection Vulnerability in anuko timetracker

MEDIUM 49

anuko timetracker is an open source time tracking system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00658 Published 2023-05-15 Fixed in 1.22.11.5781 CWE-89

TI-2023-15600 CVE-2023-32306

Time Tracker has Blind SQL Injection Vulnerability in Reports

MEDIUM 44

Time Tracker is an open source time tracking system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00721 Published 2023-05-12 Fixed in 1.22.13.5792 CWE-89

TI-2023-15370 CVE-2023-32066

Time Tracker has Stored XSS vulnerability in Week View plugin

LOW 25

Time Tracker is an open source time tracking system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00369 Published 2023-05-09 Fixed in 1.22.12.5783 CWE-79

TI-2022-08522 CVE-2022-24707

SQL injection in anuko timetracker

HIGH 71

Anuko Time Tracker is an open source, web-based time tracking application written in PHP.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07159 Published 2022-02-23 Fixed in 1.20.0.5642 CWE-89

TI-2022-08523 CVE-2022-24708

Stored XSS vulnerability in anuko/timetracker

LOW 30

Anuko Time Tracker is an open source, web-based time tracking application written in PHP.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00552 Published 2022-02-23 Fixed in 1.20.0.5646 CWE-79

TI-2021-19657 CVE-2021-43851

SQL injection vulnerability in anuko timetracker

MEDIUM 40

Anuko Time Tracker is an open source, web-based time tracking application written in PHP.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01203 Published 2021-12-21 Fixed in 1.19.33.5607 CWE-89

TI-2021-17978 CVE-2021-41139

Reflected XSS vulnerability in time.php

LOW 37

Anuko Time Tracker is an open source, web-based time tracking application written in PHP.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01023 Published 2021-10-13 Fixed in 1.19.30.5600 CWE-79

TI-2021-10149 CVE-2021-29436

Cross site request forgery in anuko timetracker

LOW 36

Anuko Time Tracker is an open source, web-based time tracking application written in PHP.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00525 Published 2021-04-13 Fixed in 1.19.27.5431 CWE-352

TI-2021-04452 CVE-2021-21352

Predictable tokens used for password resets

MEDIUM 42

Anuko Time Tracker is an open source, web-based time tracking application written in PHP.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01545 Published 2021-03-03 Fixed in 1.19.24.5415 CWE-330

TI-2020-16665 CVE-2020-27422 · GHSA-jvmc-9qmp-g6pw

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't…

MEDIUM 53

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07857 Published 2020-11-16 No fix listed CWE-613

TI-2020-16666 CVE-2020-27423 · GHSA-587h-jw63-jwf2

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which…

MEDIUM 42

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06438 Published 2020-11-16 No fix listed CWE-307

TI-2020-12027 CVE-2020-15255

CSV injection in Anuko Time Tracker

MEDIUM 44

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.03504 Published 2020-10-16 Fixed in 1.19.23.5325 CWE-74