Again we received an email from the CYBSEC S.A company that they discovered 2 vulnerabilities in Achievo 1.4.4 and below. The first one was an authorization flaw in the Time registration module, that made it possible to delete/add records of other users. The second one was a CSRF in ATK how it handles the validation of the actions. Both problems are fixed in Achievo 1.4.5.

For a full list of resolved issues, you can visit: http://www.achievo.org/download/releasenotes/1_4_5.

Sandy