Hesk
Products
1- 5 CVEs
Recent CVEs
5| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-13897 | Med | 0.40 | 6.1 | 0.01 | Jun 7, 2020 | HESK before 3.1.10 allows reflected XSS. | ||
| CVE-2005-3005 | 0.03 | — | 0.03 | Sep 21, 2005 | Helpdesk Software Hesk allows remote attackers to bypass authentication for (1) admin.php and (2) admin_main.php by modifying the PHPSESSID session ID parameter or cookie. | |||
| CVE-2011-5287 | 0.00 | — | 0.01 | Jan 1, 2015 | Multiple cross-site scripting (XSS) vulnerabilities in HESK before 2.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) hesk_settings[tmp_title] or (2) hesklang[ENCODING] parameter to inc/header.inc.php; the hesklang[attempt] parameter to (3)… | |||
| CVE-2011-3743 | 0.00 | — | 0.01 | Sep 23, 2011 | Hesk 2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/footer.inc.php and certain other files. | |||
| CVE-2005-2843 | 0.00 | — | 0.02 | Sep 8, 2005 | Helpdesk software Hesk 0.92 does not properly verify usernames and passwords, which allows remote attackers to bypass authentication via a direct request to admin_main.php. |
- risk 0.40cvss 6.1epss 0.01
HESK before 3.1.10 allows reflected XSS.
- CVE-2005-3005Sep 21, 2005risk 0.03cvss —epss 0.03
Helpdesk Software Hesk allows remote attackers to bypass authentication for (1) admin.php and (2) admin_main.php by modifying the PHPSESSID session ID parameter or cookie.
- CVE-2011-5287Jan 1, 2015risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in HESK before 2.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) hesk_settings[tmp_title] or (2) hesklang[ENCODING] parameter to inc/header.inc.php; the hesklang[attempt] parameter to (3)…
- CVE-2011-3743Sep 23, 2011risk 0.00cvss —epss 0.01
Hesk 2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/footer.inc.php and certain other files.
- CVE-2005-2843Sep 8, 2005risk 0.00cvss —epss 0.02
Helpdesk software Hesk 0.92 does not properly verify usernames and passwords, which allows remote attackers to bypass authentication via a direct request to admin_main.php.