Vendor
polonel
30 known vulnerabilities.
Products
10 results · Clear filters · Feed
-
High 7.4
Trudesk through 1.2.11 Missing Authentication on Debug Routes
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, the…
-
High 7.1
Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to …
-
High 8.8
Execution with Unnecessary Privileges in polonel/trudesk
Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.
-
High 7.6
Integer Overflow or Wraparound in polonel/trudesk
Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.
-
High 8.4
Weak Password Requirements in polonel/trudesk
Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.
-
High 8.4
Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk
Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.
-
High 8.4
Integer Overflow or Wraparound in polonel/trudesk
Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2.
-
High 7.6
Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk
Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
-
High 7.2
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can …
-
High 8.2
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.