Community-skeleton vulnerabilities
3 known vulnerabilities in Community-skeleton from Uvdesk. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
core-framework: Improper Privilege Management
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifi
- 9.8 Critical severity
community-skeleton: Missing Authentication for Critical Functionality
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting c
- 8.8 High severity
Uvdesk: Unrestricted Upload of File with Dangerous Type
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.