CVE-2021-28024: Use of Insufficiently Random Values

Unauthorized system access in the login form in ServiceTonic Helpdesk software version 9.0.35937 allows attacker to login without using a password...

CVE-2021-28022: Improper Neutralization of Special Elements used in an SQL Command

Blind SQL injection in the login form in ServiceTonic Helpdesk software 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries...

PT-2021-17713

Name of the Vulnerable Software and Affected Versions: ServiceTonic Helpdesk software versions prior to 9.0.35937 Description: The issue allows for unauthorized system access through the login form, enabling an attacker to log in without using a password. Recommendations: For versions prior to...

PT-2021-17712

Name of the Vulnerable Software and Affected Versions: ServiceTonic Helpdesk software version 9.0.35937 Description: The issue allows a malicious user to execute JSP code by uploading a zip file that extracts files in relative paths, leveraging the arbitrary file upload in the Service import...

PT-2021-17711

Name of the Vulnerable Software and Affected Versions: ServiceTonic Helpdesk software versions prior to 9.0.35937 Description: The issue allows an attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries using blind SQL injection in the login form...