Design/Logic Flaw

An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...

Razer: Helpdesk takeover (subdomain takeover) in razerzone.com domain via unclaimed Zendesk instance

The tester discovered a Razer subdomain subject to a takeover. Although we do not normally accept these as part of this program, Razer thanks the tester for his report...

Lark Technologies: Sensitive information of helpdesk is being leaked.

Due to improper access control, Larksuite help desk tickets could have been accessed by users who are not owners or admins of the helpdesk. We thank @imrannisar for reporting this to our team and verifying the resolution...

SQL Injection Vulnerability in Kaixin Helpdesk v31.0 Pc***.aspx

Kaixin Helpdesk V31.0 is a system that helps IT to collect the problems dealt with on a daily basis and generate reports to quantify the work, which is developed using ASP.NET language. A SQL injection vulnerability exists in Qixing Helpdesk v31.0 Pc.aspx, which can be exploited by attackers to...

SQL Injection Vulnerability in Qixing Helpdesk kb***_ca***.aspx Interface

Kaixin HelpdeskHelpdesk is a system for dealing with day-to-day issues that helps IT collect the issues it deals with on a daily basis and generate reports to quantify the work. A SQL injection vulnerability exists in the kbca.aspx interface of Qixing Helpdesk, which can be exploited by attackers...

DataStax: Helpdesk Takeover at dmc.datastax.com

Summary: DNS record dmc.datastax.com is pointing to stale dmc-support.zendesk.com domain on Zendesk which is available for takeover. DNS Stale Records: F661014 Proof of Concept: There was no helpdesk configured at this address, which means that the address was available and anyone could claim it....

CVE-2018-0728

This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions...

CVE-2018-0728

This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions...

Improper access control

This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions...

CVE-2018-0728

CVE-2018-0728 concerns an improper access control vulnerability in QNAP Helpdesk within QTS. The available documents indicate that the issue allows an attacker to access system logs. The fixes are to update QTS and Helpdesk to the latest versions. The exact root cause, affected version(s), and ex...

CVE-2018-0728

This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions...

SQL Injection Vulnerability in Kaixin Helpdesk System PC***_ad***.aspx

The Kairos Helpdesk System is a system for dealing with day-to-day issues. A SQL injection vulnerability exists in the Qixing Helpdesk System PCad.aspx, which can be exploited by attackers to obtain sensitive information...

Multiple QNAP Products NAS-201911-20 Multiple Security Vulnerabilities

Description Multiple QNAP products are prone to multiple security vulnerabilities. An attacker may leverage these issues to execute arbitrary commands or gain unauthorized access to the affected device. Technologies Affected Qnap Helpdesk 1.0.06 Qnap Helpdesk 1.1.01 Qnap Helpdesk 1.2.0 Qnap...

XSS Vulnerability in the Frontend of the Kaixin Helpdesk System

The Kaixin Helpdesk Helpdesk helps IT to collect the problems handled on a daily basis and generate reports to quantify the work. An XSS vulnerability exists in the frontend of the Qixing Helpdesk system, which can be exploited by attackers to obtain administrator cookie information...

Override access vulnerability in Kaixin helpdesk system

The Kaixin Helpdesk Helpdesk helps IT to collect the problems handled on a daily basis and generate reports to quantify the work. An override access vulnerability exists in the Qixing Helpdesk system, which can be exploited by an attacker to spoof the server side and achieve override operation...

Unauthorized Access Vulnerability in Kairos Helpdesk System

The Kaixin Helpdesk Helpdesk helps IT to collect the problems handled on a daily basis and generate reports to quantify the work. An unauthorized access vulnerability exists in the Qixing Helpdesk system, which can be exploited by an attacker to download system content without authorization...

Jitbit Software Helpdesk Security Feature Issue Vulnerability

Jitbit Software Helpdesk is a helpdesk ticketing system from Jitbit Software in the UK. A security feature issue vulnerability exists in Jitbit Software Helpdesk versions prior to 9.0.3 that stems from the program not handling the 'userHash' parameter correctly. A remote attacker can exploit the...

CVE-2017-18486

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote...

CVE-2017-18486

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote...

Authentication flaw

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote...