Achievo.org - Achievo Blog

Monday, September 27. 2010

Achievo 1.4.5 - Security Bugfix release

Again we received an email from the CYBSEC S.A company that they discovered 2 vulnerabilities in Achievo 1.4.4 and below. The first one was an authorization flaw in the Time registration module, that made it possible to delete/add records of other users. The second one was a CSRF in ATK how it handles the validation of the actions. Both problems are fixed in Achievo 1.4.5.

For a full list of resolved issues, you can visit: http://www.achievo.org/download/releasenotes/1_4_5.

Sandy

Posted by Sandy Pleyte in Release at 22:09 | Comments (0) | Trackbacks (0)

Defined tags for this entry: achievo, release

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

No comments

Add Comment

Name
Email
Homepage
In reply to
Comment	Enclosing asterisks marks text as bold (word), underscore are made via _word_. Standard emoticons like :-) and ;-) are converted to images. E-Mail addresses will not be displayed and will only be used for E-Mail notifications To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: BBCode format allowed
	Remember Information? Subscribe to this entry
Submitted comments will be subject to moderation before being displayed.

Calendar

Syndicate This Blog

Subscribe on RSS feed

Powered by

Show tagged entries