Masako Ohno

The issue allows remote authenticated administrators to read arbitrary files.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML.

The issue allows remote authenticated users to read other users' information due to a lack of privilege enforcement.

The issue allows remote authenticated users to impersonate arbitrary user accounts, and consequently obtain sensitive information or modify settings, due to improper authentication.

A directory traversal issue allows remote attackers to read and modify arbitrary files.

The issue allows remote attackers to execute arbitrary commands, related to a command injection vulnerability.

The issue allows remote authenticated users to bypass intended access restrictions, accessing sensitive information such as time card and attendance data. This is achieved through manipulation of a URL.

The issue allows remote authenticated users to gain privileges due to improper restrictions on additions to the membership of the operators group.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML.

The issue is related to a cross-site request forgery (CSRF) vulnerability, which allows remote attackers to hijack the authentication of administrators for requests that modify data. This can lead to unauthorized changes to data.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users for requests that make content modifications.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.