745 matches found
CVE-2024-29185 FreeScout OS Command Injection vulnerability
FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file. The value of the phppath parameter is being executed as an OS command by the shellexec function, without validating it. This allows an...
CVE-2024-29185 FreeScout OS Command Injection vulnerability
FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file. The value of the phppath parameter is being executed as an OS command by the shellexec function, without validating it. This allows an...
CVE-2024-29185
FreeScout before 1.8.128 is vulnerable to OS command injection in /public/tools.php. The php_path parameter is executed as an OS command via shell_exec without validation, enabling an attacker to run arbitrary commands on the server. Demonstrations have shown access to /etc/passwd, indicating com...
CVE-2024-29184
FreeScout before 1.8.128 is affected by a Stored XSS in the Signature Input Field. The CSP policy (script-src 'self' 'nonce-abcd') blocks inline scripts and nonces, but an attacker bypassed it by uploading a JS file via POST to /conversation/upload and then using the uploaded file’s URL as the sr...
CVE-2024-29184 FreeScout Stored XSS to Privilege Escalation After CSP Bypass
FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting XSS vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the...
CVE-2024-29184 FreeScout Stored XSS to Privilege Escalation After CSP Bypass
FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting XSS vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the...
CVE-2024-29184 FreeScout Stored XSS to Privilege Escalation After CSP Bypass
FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting XSS vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the...
FreeScout 安全漏洞
FreeScout is an ultra-lightweight and powerful free open source helpdesk and shared inbox built using PHP Laravel framework. A security vulnerability exists in FreeScout versions prior to 1.8.128, which stems from vulnerability to operating system command injection attacks...
FreeScout 安全漏洞
FreeScout is an ultra-lightweight and powerful free open source helpdesk and shared inbox built using PHP Laravel framework. A security vulnerability exists in FreeScout versions prior to 1.8.128, which stems from the discovery of a stored cross-site scripting XSS vulnerability in the Signature...
PT-2024-22790 · Freescout · Freescout
Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.128 Description: FreeScout is a self-hosted help desk and shared mailbox. The issue concerns OS Command Injection in the /public/tools.php source file. The value of the php path parameter is being executed as a...
PT-2024-22789 · Freescout · Freescout
Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.128 Description: A Stored Cross-Site Scripting XSS vulnerability has been identified within the Signature Input Field of the FreeScout Application. This occurs when user input is not properly sanitized and is...
CVE-2024-28186
FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing...
Design/Logic Flaw
FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing...
CVE-2024-28186
CVE-2024-28186 affects FreeScout (PHP). The root cause is that the application stores complete stack traces in its database, which are exposed to users via the endpoint /conversation/ajax-html/send_log?folder_id=&thread_id={id}. The stack traces reveal sensitive data, including the username and p...
CVE-2024-28186 SMTP Mail Credentials Disclosed in Error Log in freescout
FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing...
CVE-2024-28186 SMTP Mail Credentials Disclosed in Error Log in freescout
FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing...
FreeScout Log Information Disclosure Vulnerability
FreeScout is an ultra-lightweight and powerful free open source helpdesk and shared inbox built using PHP Laravel framework. A log message disclosure vulnerability exists in FreeScout versions prior to 1.8.124, which stems from a log message disclosure vulnerability in the component...
CVE-2024-1932
Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout...