Vendor
uvdesk
7 known vulnerabilities.
4 results · Clear filters · Feed
-
Medium 4.3
UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint
UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticke…
-
Medium 4.3
UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifier…
-
Medium 5.4
UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier fi…
-
Medium 4.3
Cross-site Scripting (XSS) - Stored in uvdesk/community-skeleton
Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.