Design/Logic Flaw

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths...

Design/Logic Flaw

Unauthorized system access in the login form in ServiceTonic Helpdesk software version 9.0.35937 allows attacker to login without using a password...

CVE-2021-28024

Unauthorized system access in the login form in ServiceTonic Helpdesk software version 9.0.35937 allows attacker to login without using a password...

CVE-2021-28023

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths...

CVE-2021-28022

Blind SQL injection in the login form in ServiceTonic Helpdesk software 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries...

CVE-2021-28024

Unauthorized system access in the login form in ServiceTonic Helpdesk software version 9.0.35937 allows attacker to login without using a password...

CVE-2021-28024

CVE-2021-28024 affects ServiceTonic Helpdesk prior to version 9.0.35937. The vulnerability is an improper access control in the login form that lets an attacker sign in without a password, enabling unauthorized system access. Connected documents corroborate the issue across multiple sources (Red ...

CVE-2021-28023

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths...

CVE-2021-28023

CVE-2021-28023 affects ServiceTonic Helpdesk software prior to version 9.0.35937. An arbitrary file upload vulnerability exists in the Service import feature, allowing a malicious user to execute JSP code by uploading a ZIP that extracts files using relative paths. Root cause: extraction of archi...

CVE-2021-28022

Blind SQL injection in the login form in ServiceTonic Helpdesk software 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries...

CVE-2021-28022

CVE-2021-28022 affects ServiceTonic Helpdesk software prior to 9.0.35937. The root cause is a blind SQL injection in the login form, allowing an attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries. Affected product: ServiceTonic Helpdesk. Impact stated i...

PT-2021-17711

Name of the Vulnerable Software and Affected Versions: ServiceTonic Helpdesk software versions prior to 9.0.35937 Description: The issue allows an attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries using blind SQL injection in the login form...

PT-2021-17712

Name of the Vulnerable Software and Affected Versions: ServiceTonic Helpdesk software version 9.0.35937 Description: The issue allows a malicious user to execute JSP code by uploading a zip file that extracts files in relative paths, leveraging the arbitrary file upload in the Service import...

PT-2021-17713

Name of the Vulnerable Software and Affected Versions: ServiceTonic Helpdesk software versions prior to 9.0.35937 Description: The issue allows for unauthorized system access through the login form, enabling an attacker to log in without using a password. Recommendations: For versions prior to...

CVE-2021-28024: Use of Insufficiently Random Values

Unauthorized system access in the login form in ServiceTonic Helpdesk software version 9.0.35937 allows attacker to login without using a password...

CVE-2021-28023: Unrestricted Upload of File with Dangerous Type

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths...

CVE-2021-28022: Improper Neutralization of Special Elements used in an SQL Command

Blind SQL injection in the login form in ServiceTonic Helpdesk software 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries...

Verify End-Users at the Helpdesk to Prevent Social Engineering Cyber Attack

Although organizations commonly go to great lengths to address security vulnerabilities that may exist within their IT infrastructure, an organization's helpdesk might pose a bigger threat due to social engineering attacks. Social engineering is "the art of manipulating people so they give up...

CVE-2021-40925

Cross-site scripting XSS vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $SERVER"PHPSELF" parameter...

CVE-2021-40925

Cross-site scripting XSS vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $SERVER"PHPSELF" parameter...