3465 matches found
PT-2023-15070 · Unknown · Js Help Desk
Name of the Vulnerable Software and Affected Versions: JS Help Desk plugin versions = 2.7.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...
CVE-2022-4898
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was take...
CVE-2022-4898
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was take...
Malicious Package
Overview semrush-help-menu is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...
WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Broken Access Control
Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-46840 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2e809058d839 Credit...
WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Arbitrary File Upload
Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A2: Broken Authentication Classification Arbitrary File Upload CVE CVE-2022-46839 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 21f585ae6afa Credi...
JS Help Desk < 2.7.2 - CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to SQL Injection
Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47151 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 3458eadeff2d Credits RE-ALTER Require...
WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Settings Change
Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A2: Broken Authentication Classification Settings Change CVE CVE-2022-46838 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID f5722521e19a Credits...
WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46842 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID...
Revenue Collection System 跨站脚本漏洞
Revenue Collection System is a landed property billing and payment software by Carlo Montero Individual Developer. A security vulnerability exists in Revenue Collection System v1.0, which stems from its /index.php?page=help component that allows an attacker to execute arbitrary web script or HTML...
UBUNTU-CVE-2022-41941
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...
GLPI 跨站脚本漏洞
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...
CVE-2022-41941 glpi contains XSS Stored inside Standard Interface Help Link href attribute
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...
CVE-2022-41941 glpi contains XSS Stored inside Standard Interface Help Link href attribute
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...
PT-2023-9268 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions 10.0.0 through 10.0.5 Description: The issue is related to Cross-site Scripting, where an administrator can store malicious code in help links. This can be exploited by a remote attacker to save arbitrary code in the help links...
SolarWinds Web Help Desk <= 12.7.6 Arbitrary Code Execution
The version of SolarWinds Web Help Desk installed on the remote host is prior to or equal to 12.7.6. It is, therefore, affected by an arbitrary code execution vulnerability. Through hard coded credentials, an attacker with local access to the Web Help Desk host machine allows to execute arbitrary...
CVE-2022-37310
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /!!&app=io.ox/files&cap= URI...
