313 matches found
CVE-2019-16956
SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket...
Design/Logic Flaw
SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field...
Cross site request forgery (csrf)
SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket...
CVE-2019-16956
SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket...
CVE-2019-16956
SolarWinds Web Help Desk 12.7.0 is affected by a Cross‑Site Scripting (XSS) vulnerability exploitable via the Request Type parameter in a ticket. The connected sources confirm the affected product and vulnerability class but do not provide exploit details, affected versions beyond 12.7.0, or a re...
CVE-2019-16960: Improper Neutralization of Input During Web Page Generation
SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field...
CVE-2019-16956: Improper Neutralization of Input During Web Page Generation
SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket...
PT-2021-8993
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS attacks via the Request Type parameter of a ticket. This means an attacker could potentially inject malicious scripts into the website, affecting...
SolarWinds Web Help Desk 跨站脚本漏洞
Solarwinds Web Help Desk is a suite of help desk and asset management software from Solarwinds USA. The software supports centralized knowledge base, IT asset management, project and task management, and more. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0 that...
Solarwinds WebHelpDesk 跨站脚本漏洞
SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct a cross-site scripting attack via a CSV template file with a specially craft...
PT-2021-8994
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS attacks via a crafted CSV template file, specifically by manipulating the Location Name field. This can potentially lead to the execution of...
CVE-2019-16959
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...
CVE-2019-16959
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...
Design/Logic Flaw
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...
CVE-2019-16959
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...
CVE-2019-16959
SolarWinds Web Help Desk 12.7.0 is affected by a CSV Injection (Formula Injection) vulnerability via a file attached to a ticket. The issue is described consistently across sources (CVE-2019-16959, Red Hat CVE page, NVD record). The exact root cause is not elaborated beyond the CSV/Formula Inject...
PT-2020-9849
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. Recommendations For SolarWinds Web Help Desk version 12.7.0, consider restricting the ability...
CVE-2019-16959: Improper Neutralization of Formula Elements in a CSV File
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...
SolarWinds Web Help Desk Cross-Site Scripting Vulnerability (CNVD-2020-73161)
SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the "name" field of a user account...