Cross-site Scripting in kimai2

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-3983 · ADVISORY
• kevinpapst/kimai2 commit 89bfa82 · WEB
• kevinpapst/kimai2 · PACKAGE
• kevinpapst/kimai2 release 1.16.3 · WEB
• huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413 · WEB

kevinpapst/kimai2 のその他の脆弱性

• CVE-2021-43515高 7.8CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field w…
• CVE-2021-4033中 6.5kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-3992中 6.5kimai2 is vulnerable to Improper Access Control
• CVE-2021-3985緊急 9.0kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CVE-2021-3963中 4.3kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)