Filtered by vendor Fsmlabs Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-31466 1 Fsmlabs 1 Timekeeper 2024-11-21 5.4 Medium
An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration -> Compliance -> Add a new compliance report" and "Configuration -> Timekeeper Configuration -> Add a new source there" screens, there are entry points to inject JavaScript code.
CVE-2023-31465 1 Fsmlabs 1 Timekeeper 2024-11-21 9.8 Critical
An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.