Vulnerabilities

TI-2024-34344 CVE-2024-51377 · GHSA-p4mp-f632-xp5q

An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud)…

HIGH 73

An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00481 Published 2024-11-01 No fix listed CWE-79

TI-2023-01618 CVE-2023-1724 · GHSA-63xg-rcwm-472j

Faveo Helpdesk Enterprise 6.0.1 - Privilege Escalation via Stored XSS

LOW 34

Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00467 Published 2023-06-24 No fix listed CWE-79

TI-2023-10715 CVE-2023-25350 · GHSA-qfr3-mfc8-5fjx

Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection.

MEDIUM 42

Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00805 Published 2023-03-24 No fix listed CWE-89

TI-2023-10232 CVE-2023-24625 · GHSA-99fr-5jwf-5mf5

Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user…

LOW 31

Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference (IDOR) attack.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01084 Published 2023-03-24 No fix listed CWE-639

TI-2017-05211 CVE-2017-7571 · GHSA-fj9x-rhjr-3w86

public/rolechangeadmin in Faveo 1.9.3 allows CSRF.

LOW 39

public/rolechangeadmin in Faveo 1.9.3 allows CSRF.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.02248 Published 2017-04-06 No fix listed CWE-352

Vulnerabilities

Filters

An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud)…

Faveo Helpdesk Enterprise 6.0.1 - Privilege Escalation via Stored XSS

Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection.

Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user…

public/rolechangeadmin in Faveo 1.9.3 allows CSRF.