EUVD-2020-7481

Malware in sbrugna...

CVE-2020-15488

Re:Desk 2.3 allows insecure file upload...

CVE-2020-15488

Re:Desk 2.3 allows insecure file upload...

CVE-2020-15849

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

Unrestricted file upload

Re:Desk 2.3 allows insecure file upload...

CVE-2020-15849

Re:Desk 2.3 contains a blind authenticated SQL injection in the SettingsController::actionEmailTemplates() method. A user with admin access could retrieve sensitive data, bypass authorization, and modify password-reset tokens, potentially leading to account takeovers. The issue could also enable ...

CVE-2020-15488

Re:Desk 2.3 allows insecure file upload...

CVE-2020-15488

CVE-2020-15488 affects Re:Desk 2.3 and is described as an insecure file upload vulnerability. Public records note this CVE with an NVD entry (NVD: CVE-2020-15488) and related references; associated scores indicate CVSS v2 base 5.0 (Medium) and CVSS v3.1 base 7.5 (High) with network access and low...

Sql injection

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection in getBaseCriteria() (protected/models/Ticket.php). By altering the folder GET parameter in a crafted URL, arbitrary SQL can be executed, enabling unauthenticated remote command execution via a bizRule eval() in yii/framework/web/auth/CAu...

CVE-2020-15849: Improper Neutralization of Special Elements used in an SQL Command

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

CVE-2020-15487: Improper Neutralization of Special Elements used in an SQL Command

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...