TI-2021-19477 CVE-2021-43609 · GHSA-7j49-vjx9-cwp7
An issue was discovered in Spiceworks Help Desk Server before 1.3.3.
Priority HIGH 76
An issue was discovered in Spiceworks Help Desk Server before 1.3.3.
Vulnerabilities
9 records
TI-2020-15869 CVE-2020-25901 · GHSA-6gxp-j33j-9p33
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary…
Priority LOW 35
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.
TI-2020-14562 CVE-2020-23451 · GHSA-9mw4-fp5g-pcj4
Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege…
Priority LOW 39
Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function.
TI-2020-14561 CVE-2020-23450 · GHSA-qv5f-p8rc-6j2q
Spiceworks Version <= 7.5.00107 is affected by XSS.
Priority LOW 25
Spiceworks Version <= 7.5.00107 is affected by XSS.
TI-2015-05092 CVE-2015-6021 · GHSA-ccrf-g7rm-v3cv
Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.
Priority LOW 30
Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.
TI-2017-04922 CVE-2017-7237 · GHSA-5h7f-mpgw-cxcq
The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote…
Priority MEDIUM 52
The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by leveraging the unauthenticated nature of the TFTP service for al…
TI-2012-05375 CVE-2012-6658 · GHSA-mvjr-pp8f-j699
Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote…
Priority LOW 24
Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName configuration in snmpd.con…
TI-2012-02565 CVE-2012-2956 · GHSA-c88c-rr5r-3prm
SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to…
Priority LOW 31
SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2.json.
TI-2014-03039 CVE-2014-3740 · GHSA-g2p8-j4c9-c329
Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page.