Arbitrary Code Execution

tendenci is vulnerable to arbitrary code execution. The ticketlist function in tendenci\apps\helpdesk\views\staff.py does properly restrict variables to the deserialization process and allows an attacker to enter a pickle of arbitrary size, potentially leading to arbitrary code execution...

CVE-2020-14942

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

CVE-2020-14942

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

CVE-2020-14942

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

PT-2020-14078

Name of the Vulnerable Software and Affected Versions Tendenci version 12.0.10 Description The issue concerns unrestricted deserialization in the staff.py file located in apps/helpdesk/views/. This could potentially allow for malicious activities due to the lack of restrictions on what can be...