Design/Logic Flaw

SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...

CVE-2019-16959

SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...

CVE-2019-16959

SolarWinds Web Help Desk 12.7.0 is affected by a CSV Injection (Formula Injection) vulnerability via a file attached to a ticket. The issue is described consistently across sources (CVE-2019-16959, Red Hat CVE page, NVD record). The exact root cause is not elaborated beyond the CSV/Formula Inject...

CVE-2019-16959: Improper Neutralization of Formula Elements in a CSV File

SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...

SolarWinds Web Help Desk Cross-Site Scripting Vulnerability (CNVD-2020-73161)

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the "name" field of a user account...

PT-2020-9849

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. Recommendations For SolarWinds Web Help Desk version 12.7.0, consider restricting the ability...

CVE-2019-16955

SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...

CVE-2019-16957

SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...

CVE-2019-16955

SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...

Cross site request forgery (csrf)

SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...

Design/Logic Flaw

SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...

CVE-2019-16955

CVE-2019-16955 affects SolarWinds Web Help Desk 12.7.0 and is a cross-site scripting (XSS) vulnerability triggered by an uploaded SVG document in a request. The root cause is improper handling of SVG uploads leading to script injection. Public documents (NVD, Red Hat, CNVD) confirm the issue; no ...

CVE-2019-16955

SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...

CVE-2019-16957

SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...

CVE-2019-16957

SolarWinds Web Help Desk 12.7.0 is affected by a Cross‑Site Scripting (XSS) vulnerability that can be triggered via the First Name field of a User Account. The issue is documented in CVE-2019-16957 and is consistently described across multiple feeds (NVD, Red Hat, CNVD, CVE lists). The connected ...

CVE-2019-16957: Improper Neutralization of Input During Web Page Generation

SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...

CVE-2019-16955: Improper Neutralization of Input During Web Page Generation

SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...

PT-2020-9847

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS attacks via the First Name field of a User Account. This means an attacker can inject malicious scripts into the website, potentially stealing us...

PT-2020-9846

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS via an uploaded SVG document in a request. This means an attacker could potentially inject malicious scripts into the system by uploading a...

Solarwinds WebHelpDesk cross-site scripting vulnerability

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the "name" field of a user account...