Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

CVE-2019-25317 (GCVE-0-2019-25317)

Vulnerability from nvd – Published: 2026-02-11 14:56 – Updated: 2026-06-23 16:13

Title

Kimai 2- persistent cross-site scripting (XSS)

Summary

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck

References

4 references

URL	Tags
https://www.exploit-db.com/exploits/47286	exploit
https://github.com/kevinpapst/kimai2	product
https://github.com/kevinpapst/kimai2/pull/962	issue-tracking
https://www.vulncheck.com/advisories/kimai-persis…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
kevinpapst	Kimai	Affected: 2

Date Public

2019-07-15 00:00

Credits

osamaalaa

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2019-25317",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-11T15:48:23.884015Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-11T15:53:19.542Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kimai",
          "vendor": "kevinpapst",
          "versions": [
            {
              "status": "affected",
              "version": "2"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:kimai:kimai:2:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "osamaalaa"
        }
      ],
      "datePublic": "2019-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T16:13:01.091Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-47286",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/47286"
        },
        {
          "name": "Kimai 2 GitHub Repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/kevinpapst/kimai2"
        },
        {
          "name": "GitHub Pull Request for Vulnerability Fix",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kevinpapst/kimai2/pull/962"
        },
        {
          "name": "VulnCheck Advisory: Kimai 2- persistent cross-site scripting (XSS)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kimai-persistent-cross-site-scripting-xss"
        }
      ],
      "title": "Kimai 2- persistent cross-site scripting (XSS)",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2019-25317",
    "datePublished": "2026-02-11T14:56:54.669Z",
    "dateReserved": "2026-02-11T14:39:13.197Z",
    "dateUpdated": "2026-06-23T16:13:01.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-4033 (GCVE-0-2021-4033)

Vulnerability from nvd – Published: 2021-12-09 19:55 – Updated: 2024-08-03 17:16

Title

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/e05be1f7-d00c-4cfd-939…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/1da26…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:16:03.733Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/e05be1f7-d00c-4cfd-9390-ccd9d1c737b7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/1da26e041df62c10bd8075d78f2db7854d3eee07"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-09T19:55:10.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/e05be1f7-d00c-4cfd-9390-ccd9d1c737b7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/1da26e041df62c10bd8075d78f2db7854d3eee07"
        }
      ],
      "source": {
        "advisory": "e05be1f7-d00c-4cfd-9390-ccd9d1c737b7",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-4033",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/e05be1f7-d00c-4cfd-9390-ccd9d1c737b7",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/e05be1f7-d00c-4cfd-9390-ccd9d1c737b7"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/1da26e041df62c10bd8075d78f2db7854d3eee07",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/1da26e041df62c10bd8075d78f2db7854d3eee07"
            }
          ]
        },
        "source": {
          "advisory": "e05be1f7-d00c-4cfd-9390-ccd9d1c737b7",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-4033",
    "datePublished": "2021-12-09T19:55:10.000Z",
    "dateReserved": "2021-11-29T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:16:03.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3983 (GCVE-0-2021-3983)

Vulnerability from nvd – Published: 2021-12-01 11:15 – Updated: 2024-08-03 17:09

Title

Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/89bfa…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.686Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-01T11:15:12.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0"
        }
      ],
      "source": {
        "advisory": "c96f3480-dccf-4cc2-99a4-d2b3a7462413",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3983",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0"
            }
          ]
        },
        "source": {
          "advisory": "c96f3480-dccf-4cc2-99a4-d2b3a7462413",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3983",
    "datePublished": "2021-12-01T11:15:12.000Z",
    "dateReserved": "2021-11-19T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3992 (GCVE-0-2021-3992)

Vulnerability from nvd – Published: 2021-12-01 10:45 – Updated: 2024-08-03 17:16

Title

Improper Access Control in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Improper Access Control

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-284 - Improper Access Control

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/ff9ac…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:16:03.035Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Improper Access Control"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-01T10:45:11.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5"
        }
      ],
      "source": {
        "advisory": "a0c438fb-c8e1-40cf-acc6-c8a532b80b93",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Access Control in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3992",
          "STATE": "PUBLIC",
          "TITLE": "Improper Access Control in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Improper Access Control"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-284 Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5"
            }
          ]
        },
        "source": {
          "advisory": "a0c438fb-c8e1-40cf-acc6-c8a532b80b93",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3992",
    "datePublished": "2021-12-01T10:45:11.000Z",
    "dateReserved": "2021-11-21T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:16:03.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3985 (GCVE-0-2021-3985)

Vulnerability from nvd – Published: 2021-12-01 11:05 – Updated: 2024-08-03 17:09

Title

Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity

8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/76e09…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.862Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-01T11:05:11.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5"
        }
      ],
      "source": {
        "advisory": "89d6c3de-efbd-4354-8cc8-46e999e4c5a4",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3985",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5"
            }
          ]
        },
        "source": {
          "advisory": "89d6c3de-efbd-4354-8cc8-46e999e4c5a4",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3985",
    "datePublished": "2021-12-01T11:05:11.000Z",
    "dateReserved": "2021-11-19T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3963 (GCVE-0-2021-3963)

Vulnerability from nvd – Published: 2021-11-19 11:50 – Updated: 2024-08-03 17:09

Title

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/95796…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-19T11:50:10.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514"
        }
      ],
      "source": {
        "advisory": "3abf308b-7dbd-4864-b1a9-5c45b876def8",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3963",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514"
            }
          ]
        },
        "source": {
          "advisory": "3abf308b-7dbd-4864-b1a9-5c45b876def8",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3963",
    "datePublished": "2021-11-19T11:50:10.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3957 (GCVE-0-2021-3957)

Vulnerability from nvd – Published: 2021-11-19 12:00 – Updated: 2024-08-03 17:09

Title

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

Severity

4.6 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/5fa3098a-ba02-45e0-af5…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/6b495…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.758Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/5fa3098a-ba02-45e0-af56-645e34dbc691"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/6b49535b523dcd36ec59462ee4e67e2b3a9151f3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-19T12:00:11.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/5fa3098a-ba02-45e0-af56-645e34dbc691"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/6b49535b523dcd36ec59462ee4e67e2b3a9151f3"
        }
      ],
      "source": {
        "advisory": "5fa3098a-ba02-45e0-af56-645e34dbc691",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3957",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/5fa3098a-ba02-45e0-af56-645e34dbc691",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/5fa3098a-ba02-45e0-af56-645e34dbc691"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/6b49535b523dcd36ec59462ee4e67e2b3a9151f3",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/6b49535b523dcd36ec59462ee4e67e2b3a9151f3"
            }
          ]
        },
        "source": {
          "advisory": "5fa3098a-ba02-45e0-af56-645e34dbc691",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3957",
    "datePublished": "2021-11-19T12:00:11.000Z",
    "dateReserved": "2021-11-14T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3976 (GCVE-0-2021-3976)

Vulnerability from nvd – Published: 2021-11-19 10:35 – Updated: 2024-08-03 17:09

Title

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/0567048a-118c-42ec-9f9…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/b28e9…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.628Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-19T10:35:10.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e"
        }
      ],
      "source": {
        "advisory": "0567048a-118c-42ec-9f94-b55533017406",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3976",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e"
            }
          ]
        },
        "source": {
          "advisory": "0567048a-118c-42ec-9f94-b55533017406",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3976",
    "datePublished": "2021-11-19T10:35:10.000Z",
    "dateReserved": "2021-11-18T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-25317 (GCVE-0-2019-25317)

Vulnerability from cvelistv5 – Published: 2026-02-11 14:56 – Updated: 2026-06-23 16:13

Title

Kimai 2- persistent cross-site scripting (XSS)

Summary

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck

References

4 references

URL	Tags
https://www.exploit-db.com/exploits/47286	exploit
https://github.com/kevinpapst/kimai2	product
https://github.com/kevinpapst/kimai2/pull/962	issue-tracking
https://www.vulncheck.com/advisories/kimai-persis…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
kevinpapst	Kimai	Affected: 2

Date Public

2019-07-15 00:00

Credits

osamaalaa

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2019-25317",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-11T15:48:23.884015Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-11T15:53:19.542Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kimai",
          "vendor": "kevinpapst",
          "versions": [
            {
              "status": "affected",
              "version": "2"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:kimai:kimai:2:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "osamaalaa"
        }
      ],
      "datePublic": "2019-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T16:13:01.091Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-47286",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/47286"
        },
        {
          "name": "Kimai 2 GitHub Repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/kevinpapst/kimai2"
        },
        {
          "name": "GitHub Pull Request for Vulnerability Fix",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kevinpapst/kimai2/pull/962"
        },
        {
          "name": "VulnCheck Advisory: Kimai 2- persistent cross-site scripting (XSS)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kimai-persistent-cross-site-scripting-xss"
        }
      ],
      "title": "Kimai 2- persistent cross-site scripting (XSS)",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2019-25317",
    "datePublished": "2026-02-11T14:56:54.669Z",
    "dateReserved": "2026-02-11T14:39:13.197Z",
    "dateUpdated": "2026-06-23T16:13:01.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-4033 (GCVE-0-2021-4033)

Vulnerability from cvelistv5 – Published: 2021-12-09 19:55 – Updated: 2024-08-03 17:16

Title

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/e05be1f7-d00c-4cfd-939…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/1da26…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:16:03.733Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/e05be1f7-d00c-4cfd-9390-ccd9d1c737b7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/1da26e041df62c10bd8075d78f2db7854d3eee07"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-09T19:55:10.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/e05be1f7-d00c-4cfd-9390-ccd9d1c737b7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/1da26e041df62c10bd8075d78f2db7854d3eee07"
        }
      ],
      "source": {
        "advisory": "e05be1f7-d00c-4cfd-9390-ccd9d1c737b7",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-4033",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/e05be1f7-d00c-4cfd-9390-ccd9d1c737b7",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/e05be1f7-d00c-4cfd-9390-ccd9d1c737b7"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/1da26e041df62c10bd8075d78f2db7854d3eee07",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/1da26e041df62c10bd8075d78f2db7854d3eee07"
            }
          ]
        },
        "source": {
          "advisory": "e05be1f7-d00c-4cfd-9390-ccd9d1c737b7",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-4033",
    "datePublished": "2021-12-09T19:55:10.000Z",
    "dateReserved": "2021-11-29T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:16:03.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3983 (GCVE-0-2021-3983)

Vulnerability from cvelistv5 – Published: 2021-12-01 11:15 – Updated: 2024-08-03 17:09

Title

Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/89bfa…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.686Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-01T11:15:12.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0"
        }
      ],
      "source": {
        "advisory": "c96f3480-dccf-4cc2-99a4-d2b3a7462413",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3983",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0"
            }
          ]
        },
        "source": {
          "advisory": "c96f3480-dccf-4cc2-99a4-d2b3a7462413",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3983",
    "datePublished": "2021-12-01T11:15:12.000Z",
    "dateReserved": "2021-11-19T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3985 (GCVE-0-2021-3985)

Vulnerability from cvelistv5 – Published: 2021-12-01 11:05 – Updated: 2024-08-03 17:09

Title

Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity

8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/76e09…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.862Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-01T11:05:11.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5"
        }
      ],
      "source": {
        "advisory": "89d6c3de-efbd-4354-8cc8-46e999e4c5a4",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3985",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5"
            }
          ]
        },
        "source": {
          "advisory": "89d6c3de-efbd-4354-8cc8-46e999e4c5a4",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3985",
    "datePublished": "2021-12-01T11:05:11.000Z",
    "dateReserved": "2021-11-19T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3992 (GCVE-0-2021-3992)

Vulnerability from cvelistv5 – Published: 2021-12-01 10:45 – Updated: 2024-08-03 17:16

Title

Improper Access Control in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Improper Access Control

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-284 - Improper Access Control

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/ff9ac…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:16:03.035Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Improper Access Control"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-01T10:45:11.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5"
        }
      ],
      "source": {
        "advisory": "a0c438fb-c8e1-40cf-acc6-c8a532b80b93",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Access Control in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3992",
          "STATE": "PUBLIC",
          "TITLE": "Improper Access Control in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Improper Access Control"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-284 Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5"
            }
          ]
        },
        "source": {
          "advisory": "a0c438fb-c8e1-40cf-acc6-c8a532b80b93",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3992",
    "datePublished": "2021-12-01T10:45:11.000Z",
    "dateReserved": "2021-11-21T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:16:03.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3957 (GCVE-0-2021-3957)

Vulnerability from cvelistv5 – Published: 2021-11-19 12:00 – Updated: 2024-08-03 17:09

Title

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

Severity

4.6 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/5fa3098a-ba02-45e0-af5…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/6b495…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.758Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/5fa3098a-ba02-45e0-af56-645e34dbc691"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/6b49535b523dcd36ec59462ee4e67e2b3a9151f3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-19T12:00:11.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/5fa3098a-ba02-45e0-af56-645e34dbc691"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/6b49535b523dcd36ec59462ee4e67e2b3a9151f3"
        }
      ],
      "source": {
        "advisory": "5fa3098a-ba02-45e0-af56-645e34dbc691",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3957",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/5fa3098a-ba02-45e0-af56-645e34dbc691",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/5fa3098a-ba02-45e0-af56-645e34dbc691"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/6b49535b523dcd36ec59462ee4e67e2b3a9151f3",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/6b49535b523dcd36ec59462ee4e67e2b3a9151f3"
            }
          ]
        },
        "source": {
          "advisory": "5fa3098a-ba02-45e0-af56-645e34dbc691",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3957",
    "datePublished": "2021-11-19T12:00:11.000Z",
    "dateReserved": "2021-11-14T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3963 (GCVE-0-2021-3963)

Vulnerability from cvelistv5 – Published: 2021-11-19 11:50 – Updated: 2024-08-03 17:09

Title

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/95796…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-19T11:50:10.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514"
        }
      ],
      "source": {
        "advisory": "3abf308b-7dbd-4864-b1a9-5c45b876def8",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3963",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514"
            }
          ]
        },
        "source": {
          "advisory": "3abf308b-7dbd-4864-b1a9-5c45b876def8",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3963",
    "datePublished": "2021-11-19T11:50:10.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3976 (GCVE-0-2021-3976)

Vulnerability from cvelistv5 – Published: 2021-11-19 10:35 – Updated: 2024-08-03 17:09

Title

Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

Summary

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/0567048a-118c-42ec-9f9…	x_refsource_CONFIRM
https://github.com/kevinpapst/kimai2/commit/b28e9…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kevinpapst	kevinpapst/kimai2	Affected: unspecified , < 1.16.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.628Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kevinpapst/kimai2",
          "vendor": "kevinpapst",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-19T10:35:10.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e"
        }
      ],
      "source": {
        "advisory": "0567048a-118c-42ec-9f94-b55533017406",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3976",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kevinpapst/kimai2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.16.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "kevinpapst"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406"
            },
            {
              "name": "https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e",
              "refsource": "MISC",
              "url": "https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e"
            }
          ]
        },
        "source": {
          "advisory": "0567048a-118c-42ec-9f94-b55533017406",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3976",
    "datePublished": "2021-11-19T10:35:10.000Z",
    "dateReserved": "2021-11-18T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

16 vulnerabilities by kevinpapst

CVE-2019-25317 (GCVE-0-2019-25317)

CVE-2021-4033 (GCVE-0-2021-4033)

CVE-2021-3983 (GCVE-0-2021-3983)

CVE-2021-3992 (GCVE-0-2021-3992)

CVE-2021-3985 (GCVE-0-2021-3985)

CVE-2021-3963 (GCVE-0-2021-3963)

CVE-2021-3957 (GCVE-0-2021-3957)

CVE-2021-3976 (GCVE-0-2021-3976)

CVE-2019-25317 (GCVE-0-2019-25317)

CVE-2021-4033 (GCVE-0-2021-4033)

CVE-2021-3983 (GCVE-0-2021-3983)

CVE-2021-3985 (GCVE-0-2021-3985)

CVE-2021-3992 (GCVE-0-2021-3992)

CVE-2021-3957 (GCVE-0-2021-3957)

CVE-2021-3963 (GCVE-0-2021-3963)

CVE-2021-3976 (GCVE-0-2021-3976)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

16 vulnerabilities by kevinpapst

CVE-2019-25317 (GCVE-0-2019-25317)

CVE-2021-4033 (GCVE-0-2021-4033)

CVE-2021-3983 (GCVE-0-2021-3983)

CVE-2021-3992 (GCVE-0-2021-3992)

CVE-2021-3985 (GCVE-0-2021-3985)

CVE-2021-3963 (GCVE-0-2021-3963)

CVE-2021-3957 (GCVE-0-2021-3957)

CVE-2021-3976 (GCVE-0-2021-3976)

CVE-2019-25317 (GCVE-0-2019-25317)

CVE-2021-4033 (GCVE-0-2021-4033)

CVE-2021-3983 (GCVE-0-2021-3983)

CVE-2021-3985 (GCVE-0-2021-3985)

CVE-2021-3992 (GCVE-0-2021-3992)

CVE-2021-3957 (GCVE-0-2021-3957)

CVE-2021-3963 (GCVE-0-2021-3963)

CVE-2021-3976 (GCVE-0-2021-3976)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.