Titra
Monthly
titra 0.99.52 leaks sensitive global configuration settings to any authenticated user via an unprotected Meteor DDP publication, exposing API keys and OAuth secrets without administrative checks. Authenticated attackers can subscribe to the globalsettings publication and retrieve plaintext credentials including google_secret, openai_apikey, and google_clientid. No public patch is available at time of publication.
Titra time tracking software versions 0.99.49 and below contain a mass assignment vulnerability in their API that allows authenticated users to inject arbitrary fields into time entries through an unvalidated customfields parameter, enabling attackers to overwrite protected data such as user IDs, hours, and entry states. Public exploit code exists for this vulnerability which affects the integrity of tracked time data. The issue is resolved in version 0.99.50.
Unauthorized access control in Titra versions 0.99.49 and earlier enables authenticated users to view and modify time entries belonging to other users in private projects without proper authorization. Public exploit code exists for this vulnerability, affecting deployments that have not upgraded to version 0.99.50. The flaw allows authenticated attackers to compromise data integrity and confidentiality of other users' tracked time information.
Remote code execution in Titra time-tracking software prior to version 0.99.49 allows an authenticated Admin user to inject arbitrary JavaScript through the global 'timeEntryRule' setting, which is passed unsanitized into a NodeVM sandbox and executed on the server. Because the weakness sits behind the admin login boundary (CVSS vector PR:H), a non-admin or unauthenticated attacker cannot reach the vulnerable setting, but any holder of an Admin account achieves full confidentiality, integrity, and availability impact across the host - worsened in default Docker deployments where the process historically ran as root. Publicly available exploit code exists and the vendor has released a fix in 0.99.49, so this should be treated as a high-priority patch for internet-exposed instances with multiple administrators.
Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
titra 0.99.52 leaks sensitive global configuration settings to any authenticated user via an unprotected Meteor DDP publication, exposing API keys and OAuth secrets without administrative checks. Authenticated attackers can subscribe to the globalsettings publication and retrieve plaintext credentials including google_secret, openai_apikey, and google_clientid. No public patch is available at time of publication.
Titra time tracking software versions 0.99.49 and below contain a mass assignment vulnerability in their API that allows authenticated users to inject arbitrary fields into time entries through an unvalidated customfields parameter, enabling attackers to overwrite protected data such as user IDs, hours, and entry states. Public exploit code exists for this vulnerability which affects the integrity of tracked time data. The issue is resolved in version 0.99.50.
Unauthorized access control in Titra versions 0.99.49 and earlier enables authenticated users to view and modify time entries belonging to other users in private projects without proper authorization. Public exploit code exists for this vulnerability, affecting deployments that have not upgraded to version 0.99.50. The flaw allows authenticated attackers to compromise data integrity and confidentiality of other users' tracked time information.
Remote code execution in Titra time-tracking software prior to version 0.99.49 allows an authenticated Admin user to inject arbitrary JavaScript through the global 'timeEntryRule' setting, which is passed unsanitized into a NodeVM sandbox and executed on the server. Because the weakness sits behind the admin login boundary (CVSS vector PR:H), a non-admin or unauthenticated attacker cannot reach the vulnerable setting, but any holder of an Admin account achieves full confidentiality, integrity, and availability impact across the host - worsened in default Docker deployments where the process historically ran as root. Publicly available exploit code exists and the vendor has released a fix in 0.99.49, so this should be treated as a high-priority patch for internet-exposed instances with multiple administrators.
Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.