CVE-2020-13994

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the server via a ticket because of improper access control of uploaded resources. This might be exploitable in conjunction with CVE-2020-13992 by an unauthenticated attacker...

CVE-2020-13994

The CVE-2020-13992/CVE-2020-13994 entries apply to Mods for HESK 3.1.0 through 2019.1.0. CVE-2020-13992 describes a Stored XSS flaw that lets remote unauthenticated attackers abuse a helpdesk user’s session when a user with privileges to change the login-page image opens a crafted ticket. CVE-202...

CVE-2020-13993

CVE-2020-13993 affects Mods for HESK (versions 3.1.0 through 2019.1.0). The connected sources describe a blind time-based SQL injection vulnerability that allows remote unauthenticated attackers to retrieve information from the database via a ticket. No exploitation details or patch information a...

CVE-2020-13993

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A blind time-based SQL injection issue allows remote unauthenticated attackers to retrieve information from the database via a ticket...

CVE-2020-13992

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket...

CVE-2020-13992

The CVE-2020-13992 issue affects Mods for HESK (versions 3.1.0 through 2019.1.0). It describes a Stored XSS that allows remote unauthenticated attackers to abuse a helpdesk user’s logged-in session. The attack requires a user with enough privileges to change the login-page image to open a crafted...

CVE-2020-13994: Unrestricted Upload of File with Dangerous Type

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the server via a ticket because of improper access control of uploaded resources. This might be exploitable in conjunction with CVE-2020-13992 by an unauthenticated attacker...

CVE-2020-13993: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A blind time-based SQL injection issue allows remote unauthenticated attackers to retrieve information from the database via a ticket...

CVE-2020-13992: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket...

CVE-2020-13897

HESK before 3.1.10 allows reflected XSS...

CVE-2020-13897

HESK before 3.1.10 allows reflected XSS...

Cross site scripting

HESK before 3.1.10 allows reflected XSS...

CVE-2020-13897

CVE-2020-13897 affects HESK (Klemen Stirn HESK) prior to version 3.1.10. The vulnerability is a reflected XSS condition due to insufficient validation of client-side data in the WEB application, enabling an attacker to inject and execute script in a victim’s browser when the vulnerable page is lo...

CVE-2020-13897

HESK before 3.1.10 allows reflected XSS...

Multiple Cross-Site Scripting Vulnerabilities in HESK

HESK is a free PHP helpdesk software. The software supports the creation of a web-based ticket support system helpdesk for websites and the management of customer requests through a web interface. Multiple cross-site scripting vulnerabilities exist in versions of HESK prior to 2.4.1, which allow...

CVE-2011-5287

Multiple cross-site scripting XSS vulnerabilities in HESK before 2.4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 hesksettingstmptitle or 2 hesklangENCODING parameter to inc/header.inc.php; the hesklangattempt parameter to 3 inc/assignmentsearch.inc.php, 4...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in HESK before 2.4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 hesksettingstmptitle or 2 hesklangENCODING parameter to inc/header.inc.php; the hesklangattempt parameter to 3 inc/assignmentsearch.inc.php, 4...

CVE-2011-5287

Multiple cross-site scripting XSS vulnerabilities in HESK before 2.4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 hesksettingstmptitle or 2 hesklangENCODING parameter to inc/header.inc.php; the hesklangattempt parameter to 3 inc/assignmentsearch.inc.php, 4...

CVE-2011-5287

CVE-2011-5287 affects HESK prior to version 2.4.1, with multiple XSS vectors in PHP files (inc/header.inc.php and several inc/*.inc.php scripts) and PATH_INFO to language/en/text.php. The root cause is insufficient sanitization of user-supplied input, enabling remote script/HTML injection via par...

CVE-2011-5287: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in HESK before 2.4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 hesksettingstmptitle or 2 hesklangENCODING parameter to inc/header.inc.php; the hesklangattempt parameter to 3 inc/assignmentsearch.inc.php, 4...