CVE-2022-24708

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.

• CWE-79

• https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5eb4330Patch, Third Party Advisory
• https://github.com/anuko/timetracker/security/advisories/GHSA-rgcm-xgvj-5mqhThird Party Advisory
• https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5eb4330Patch, Third Party Advisory
• https://github.com/anuko/timetracker/security/advisories/GHSA-rgcm-xgvj-5mqhThird Party Advisory

Published

Feb 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24701An issue was discovered in WinAPRS 2.9.0. A buffer overflow …7.8
• CVE-2022-24702An issue was discovered in WinAPRS 2.9.0. A buffer overflow …9.8
• CVE-2022-24704The rad_packet_recv function in opt/src/accel-pppd/radius/pa…9.8
• CVE-2022-24705The rad_packet_recv function in radius/packet.c suffers from…9.8
• CVE-2022-24706In Apache CouchDB prior to 3.2.2, an attacker can access an …9.8
• CVE-2022-24707Anuko Time Tracker is an open source, web-based time trackin…8.8
• CVE-2022-24709@awsui/components-react is the main AWS UI package which con…6.1
• CVE-2022-2471Stack-based Buffer Overflow vulnerability in the EZVIZ Motio…9.8
• CVE-2022-24710Weblate is a copyleft software web-based continuous localiza…5.4
• CVE-2022-24711CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…9.8
• CVE-2022-24712CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…8.8
• CVE-2022-24713regex is an implementation of regular expressions for the Ru…7.5