The Ariba Spend Mangement System, which is a web-based application, appears to transmit the username and password of the user to the server via the URL in plain text. Packet capture is available for analysis upon request. This may enable a malicious user to sniff the username/password for accounts in the 'approval' role (for example, the CFO/CTO/CEO), which would allow the user to purchase items they are not normally permitted to. Gerald.