3 ways Microsoft 365 can help you reduce helpdesk costs

With more people than ever working remotely, organizations must maximize employee productivity while protecting an ever-growing digital footprint. Many have stitched together specialized security solutions from different vendors to improve their cybersecurity posture, but this approach is expensi...

Lark Technologies: Stored xss on helpdesk using user's city

A stored XSS cross-site scripting was found on the internal larksuite helpdesk, which an attacker could have potentially used to obtain access to the internal helpdesk. We thank imrannisar for reporting this vulnerability and confirming its resolution...

CVE-2020-12684

XXE injection can occur in i-net Clear Reports 2019 19.0.287 Designer, as used in i-net HelpDesk and other products, when XML input containing a reference to an external entity is processed by a weakly configured XML parser...

CVE-2020-13992

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket...

CVE-2020-13992

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket...

Cross site scripting

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket...

CVE-2020-13992

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket...

Unspecified Vulnerability in QNAP Systems Helpdesk

QNAP Systems Helpdesk is a helpdesk application from China Weilian QNAP Systems. A security vulnerability exists in QNAP Systems Helpdesk versions prior to 3.0.1. An attacker can access QNAP Systems Helpdesk with the help of an API? key to access sensitive data on the QNAP Kayako server...

CVE-2020-2500

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and...

Improper access control

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and...

CVE-2020-2500

The CVE-2020-2500 entry concerns QNAP Helpdesk (Kayako service). The vulnerability is an improper access control flaw that allows an attacker to access sensitive data on the QNAP Kayako server by abusing API keys, potentially enabling control over the Helpdesk component. The underlying issue is a...

CVE-2020-2500

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and...

helpdesk.openmobilealliance.org Cross Site Scripting vulnerability OBB-1208174

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Arbitrary Code Execution

tendenci is vulnerable to arbitrary code execution. The ticketlist function in tendenci\apps\helpdesk\views\staff.py does properly restrict variables to the deserialization process and allows an attacker to enter a pickle of arbitrary size, potentially leading to arbitrary code execution...

PYSEC-2020-112

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

Deserialization of untrusted data

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

PYSEC-2020-112

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

CVE-2020-14942

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py. Recent assessments: kevthehermit at June 21, 2020 7:03pm UTC reported: Outline Untrusted data from the client side is used to create a python pickled object. This can lead to full RCE and compromise of the host...

PT-2020-14078

Name of the Vulnerable Software and Affected Versions Tendenci version 12.0.10 Description The issue concerns unrestricted deserialization in the staff.py file located in apps/helpdesk/views/. This could potentially allow for malicious activities due to the lack of restrictions on what can be...

Zammad is vulnerable to authorization issues

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from an authorization issue vulnerability that can be exploited by an attacker to register a new account using an email address that contains a non-existent domain of an existing organization, which in turn can be...