uvdesk

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

uvdesk records in CISA KEV

No uvdesk vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

4 records in Community-skeleton · all components

TI-2023-19200 CVE-2023-37635 · GHSA-jhv5-cxf2-r67v

HIGH 82

UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01382 Published 2023-10-23 No fix listed CWE-307

TI-2023-00251 CVE-2023-0265 · GHSA-2hw6-4rv9-82fp

HIGH 73

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01601 Published 2023-04-04 No fix listed CWE-434

TI-2023-00309 CVE-2023-0325 · GHSA-fwhv-9phj-wrj5

MEDIUM 60

Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00687 Published 2023-04-04 No fix listed CWE-79

TI-2023-01132 CVE-2023-1197 · GHSA-hfxp-j95j-cwrp

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00398 Published 2023-03-06 Fixed in 1.1.0 CWE-79