Spiceworks - vulnerabilities (CVEs)

9 CVEs in 3 products, 0 in the last 30 days, newest from 2023-11-09.

Products

• Spiceworks - 7 CVEs
• Desktop - 1 CVEs
• Help Desk Server - 1 CVEs

Newest CVEs of Spiceworks

• CVE-2021-43609 - CVSS 9.9 (critical), 2023-11-09: An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in…
• CVE-2020-25901 - CVSS 6.1 (medium), 2020-12-18: Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header…
• CVE-2020-23451 - CVSS 8.8 (high), 2020-09-15: Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function.
• CVE-2020-23450 - CVSS 5.4 (medium), 2020-09-01: Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on…
• CVE-2015-6021 - CVSS 6.1 (medium), 2017-04-10: Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.
• CVE-2017-7237 - CVSS 9.8 (critical), 2017-04-06: The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by…
• CVE-2012-6658 - CVSS 4.3 (medium), 2014-09-17: Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the (1)…
• CVE-2012-2956 - CVSS 6.5 (medium), 2014-09-17: SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2.json.…
• CVE-2014-3740 - CVSS 3.5 (low), 2014-09-11: Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the…