Deskpro Deskpro
13 CVEs affecting Deskpro Deskpro. Latest disclosed: 2023-07-21. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11465 | High | 8.8 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a user's privilege, allowing an attacker to control/i… |
CVE-2020-11463 | High | 7.5 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/email_accounts endpoint failed to properly validate a user's privilege, allowing an attacker to re… |
CVE-2021-35391 | High | 7.2 | 2023-07-21 | Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL. |
CVE-2020-11467 | High | 7.2 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-them… |
CVE-2021-36695 | Medium | 5.4 | 2021-09-08 | Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in the download file feature on… |
CVE-2021-36696 | Medium | 5.4 | 2021-09-07 | Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user… |
CVE-2020-28722 | Medium | 5.4 | 2021-05-12 | Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting (XSS) vulnerability that can lead to an account takeover v… |
CVE-2020-11466 | Medium | 4.3 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve… |
CVE-2020-11464 | Medium | 4.3 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve s… |
CVE-2007-2011 | | 2007-04-12 | Cross-site scripting (XSS) vulnerability in login.php in DeskPro 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the username paramete… | |
CVE-2007-1012 | | 2007-02-21 | Cross-site scripting (XSS) vulnerability in faq.php in DeskPRO 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the article parameter. | |
CVE-2006-6159 | | 2006-11-28 | Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML v… | |
CVE-2003-0874 | | 2003-11-17 | Multiple SQL injection vulnerabilities in DeskPRO 1.1.0 and earlier allow remote attackers to insert arbitrary SQL and conduct unauthorized activities via (1)… |