Vulnerabilities

TI-2021-09304 CVE-2021-28024 · GHSA-vv54-c2m8-pw38

Unauthorized system access in the login form in ServiceTonic Helpdesk software version <…

MEDIUM 45

Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a password.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01354 Published 2021-11-08 No fix listed CWE-330

TI-2021-09303 CVE-2021-28023 · GHSA-qpwx-f5jx-qhf4

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version…

MEDIUM 45

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01354 Published 2021-11-08 No fix listed CWE-434

TI-2021-09302 CVE-2021-28022 · GHSA-35rr-mpm9-g6jw

Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937…

LOW 35

Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01152 Published 2021-11-08 No fix listed CWE-89

Vulnerabilities

Filters

Unauthorized system access in the login form in ServiceTonic Helpdesk software version <…

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version…

Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937…