Worktime vulnerabilities
3 known vulnerabilities in Worktime from NesterSoft. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
WorkTime (on-prem/cloud): Improper Privilege Management
An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is
- 8.8 High severity
WorkTime (on-prem/cloud): Improper Neutralization of Special Elements used in an SQL Command
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL
- 9.8 Critical severity
WorkTime (on-prem/cloud): Improper Neutralization of Special Elements used in an OS Command
An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attack