Packagist (Composer) package

kevinpapst/kimai2

pkg:composer/kevinpapst/kimai2

Vulnerabilities (9)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2021-43515	Hig	7.8	< 1.14.1	1.14.1	Apr 8, 2022	CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
CVE-2021-4033	Med	6.5	< 1.16.7	1.16.7	Dec 9, 2021	kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3983	Med	6.1	< 1.16.3	1.16.3	Dec 1, 2021	kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3992	Med	6.5	< 1.16.3	1.16.3	Dec 1, 2021	kimai2 is vulnerable to Improper Access Control
CVE-2021-3985	Cri	9.0	< 1.16.3	1.16.3	Dec 1, 2021	kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3963	Med	4.3	< 1.16	1.16	Nov 19, 2021	kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3957	Med	4.3	< 1.16	1.16	Nov 19, 2021	kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3976	Med	6.5	< 1.16.2	1.16.2	Nov 19, 2021	kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2019-15481	Med	6.1	< 1.1	1.1	Aug 23, 2019	Kimai v2 before 1.1 has XSS via a timesheet description.

CVE-2021-43515HigApr 8, 2022
affected < 1.14.1fixed 1.14.1
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
CVE-2021-4033MedDec 9, 2021
affected < 1.16.7fixed 1.16.7
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3983MedDec 1, 2021
affected < 1.16.3fixed 1.16.3
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3992MedDec 1, 2021
affected < 1.16.3fixed 1.16.3
kimai2 is vulnerable to Improper Access Control
CVE-2021-3985CriDec 1, 2021
affected < 1.16.3fixed 1.16.3
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3963MedNov 19, 2021
affected < 1.16fixed 1.16
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3957MedNov 19, 2021
affected < 1.16fixed 1.16
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3976MedNov 19, 2021
affected < 1.16.2fixed 1.16.2
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2019-15481MedAug 23, 2019
affected < 1.1fixed 1.1
Kimai v2 before 1.1 has XSS via a timesheet description.