103 matches found
Spiceworks Security Breach
Spiceworks is an IT management software from the Spiceworks community. It focuses on simplifying the process of inventorying, monitoring networks, and generating reports for IT professionals in small and medium-sized businesses. A security vulnerability exists in Spiceworks Help Desk Server...
CVE-2021-43609
CVE-2021-43609 affects Spiceworks Help Desk Server prior to 1.3.3. A blind boolean SQL injection in the sort parameter via the order_by_for_ticket function (app/models/reporting/database_query.rb) allows an authenticated attacker to execute arbitrary SQL commands, enabling leakage of local files ...
CVE-2021-43609
An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the orderbyforticket function in app/models/reporting/databasequery.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be...
Exploit for SQL Injection in Spiceworks Help_Desk_Server
Spiceworks Sort SQLi There's a SQLi in a sort parameter of...
Spiceworks Input Validation Error Vulnerability
SpiceWorks is a suite of network device management and monitoring software for small and medium-sized businesses from Spiceworks, Inc. An input validation error vulnerability exists in Spiceworks 7.5.7.0, which allows an attacker to render arbitrary links that point to malicious websites with tox...
Spiceworks 7.5 - HTTP Header Injection
Exploit Title: Spiceworks 7.5 - HTTP Header Injection Google Dork: inurl:/prousers/login Discovered Date: 15/09/2020 Exploit Author: Ramikan Vendor Homepage: https://www.spiceworks.com Affected Version: 7.5.7.0 may be others. Tested On Version: 7.5.7.0 CVE : CVE-2020-25901 Vulnerability: Host...
Spiceworks 7.5 HTTP Header Injection
Exploit Title: Spiceworks 7.5 - HTTP Header Injection Google Dork: inurl:/prousers/login Discovered Date: 15/09/2020 Exploit Author: Ramikan Vendor Homepage: https://www.spiceworks.com Affected Version: 7.5.7.0 may be others. Tested On Version: 7.5.7.0 CVE : CVE-2020-25901 Vulnerability: Host...
CVE-2020-25901
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...
CVE-2020-25901
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...
Design/Logic Flaw
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...
CVE-2020-25901
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...
CVE-2020-25901
CVE-2020-25901 affects Spiceworks (v7.5.7.0) via a Host Header Injection in the HTTP handling, enabling an attacker to render arbitrary links to a malicious site using poisoned Host headers. Public references indicate exploitation activity (e.g., Exploit-DB entry for Spiceworks 7.5.7.0 HTTP Heade...
CVE-2020-25901: URL Redirection to Untrusted Site
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages...
Spiceworks 输入验证错误漏洞
SpiceWorks is a suite of network device management and monitoring software for small and medium-sized businesses from Spiceworks, Inc. An input validation error vulnerability exists in Spiceworks 7.5.7.0, which allows an attacker to render arbitrary links that point to malicious websites with tox...
CVE-2020-23451
Spiceworks Version = 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function...
CVE-2020-23451
Spiceworks Version = 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function...
Cross site request forgery (csrf)
Spiceworks Version = 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function...
CVE-2020-23451
Spiceworks Version = 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function...
CVE-2020-23451
CVE-2020-23451 affects Spiceworks. A CSRF flaw in the /settings/v1/users path can lead to privilege escalation in Spiceworks Version
PT-2020-15561
Name of the Vulnerable Software and Affected Versions Spiceworks versions prior to 7.5.00108 Description The issue allows for privilege escalation via the "/settings/v1/users" API endpoint. This can be exploited due to a CSRF flaw. Recommendations For versions prior to 7.5.00108, update to versio...