Vulnerabilities

TI-2023-19200 CVE-2023-37635 · GHSA-jhv5-cxf2-r67v

UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force…

HIGH 82

UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01382 Published 2023-10-23 No fix listed CWE-307

TI-2023-00309 CVE-2023-0325 · GHSA-fwhv-9phj-wrj5

MEDIUM 60

Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00687 Published 2023-04-04 No fix listed CWE-79

TI-2023-00251 CVE-2023-0265 · GHSA-2hw6-4rv9-82fp

HIGH 73

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01601 Published 2023-04-04 No fix listed CWE-434

TI-2023-01132 CVE-2023-1197 · GHSA-hfxp-j95j-cwrp

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00398 Published 2023-03-06 Fixed in 1.1.0 CWE-79