Vulnerabilidades

TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has…

Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function.

Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service.

Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4.

Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.

Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3.

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3.

Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.

Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.

Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3.

Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2.

Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.

Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.

Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.

Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2.

Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.

Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.

Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.