CVE-2023-26982

CVE-2023-26982 漏洞说明： Trudesk v1.2.6被发现包含一个存储型跨站脚本（XSS）漏洞，该漏洞位于创建工单（Create Ticket）功能下的“添加标签”（Add Tags）参数中。 攻击向量： 攻击者必须先创建一个工单，然后在工单中编辑标签，在“添加标签”（Add Tags）输入框和“创建标签”（Create Tag）处插入XSS载荷，以利用存储型XSS。保存后XSS载荷将立即触发。 受影响范围： http://ip:8118/tickets/ID POST /api/v1/tags/create 参数 : tag 载荷： 测试环境： 1. Trudesk ...

Duplicate-of-CVE-2023-26982

Trudesk 版本 1.2.6 漏洞说明： Trudesk 1.2.6 版本被发现存在一个存储型跨站脚本（XSS）漏洞，通过工单 创建/修改工单标签 功能，涉及管理员角色。 攻击向量： 攻击者需要进入设置菜单，选择工单，然后向下滚动找到工单标签。点击 创建，在 添加标签 输入框中插入 XSS 有效载荷，创建标签 即可利用存储型 XSS。保存后 XSS 有效载荷会立即执行。 受影响： http://IP:8118/settings/tickets POST /api/v1/tags/create Parameter : tag 有效载荷： 测试环境： 1. Trudesk 1.2.6 版...

EUVD-2022-25035

Malicious code in bioql PyPI...

EUVD-2022-34414

Malicious code in bioql PyPI...

EUVD-2022-25000

Malicious code in bioql PyPI...

EUVD-2022-25200

Malicious code in bioql PyPI...

EUVD-2022-24392

Malicious code in bioql PyPI...

EUVD-2022-25198

Malicious code in bioql PyPI...

EUVD-2022-25033

Malicious code in bioql PyPI...

EUVD-2022-25051

Malicious code in bioql PyPI...

EUVD-2022-25087

Malicious code in bioql PyPI...

EUVD-2023-30772

Malicious code in bioql PyPI...

EUVD-2022-25001

Malicious code in bioql PyPI...

EUVD-2022-25082

Malicious code in bioql PyPI...

EUVD-2022-25056

Malicious code in bioql PyPI...

EUVD-2022-25009

Malicious code in bioql PyPI...

CVE-2023-26982

Trudesk v1.2.6 was discovered to contain a stored cross-site scripting XSS vulnerability via the Add Tags parameter under the Create Ticket function...

CVE-2022-1893

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3...

CVE-2022-1719

Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page...

CVE-2021-45785

TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery CSRF attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the vict...