Trudesk Project Trudesk

Incorrect Use of Privileged APIs in polonel/trudesk

Improper Privilege Management in polonel/trudesk

Unrestricted Upload of File with Dangerous Type in polonel/trudesk

Weak Password Requirements in polonel/trudesk

Incorrect Synchronization in polonel/trudesk

Use of Incorrect Operator in polonel/trudesk

Unrestricted Upload of File with Dangerous Type in polonel/trudesk

Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk

Stored XSS viva .svg file upload in polonel/trudesk

Execution with Unnecessary Privileges in polonel/trudesk

Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk

Integer Overflow or Wraparound in polonel/trudesk

Trudesk through 1.2.11 Missing Authentication on Debug Routes

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk

Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

Integer Overflow or Wraparound in polonel/trudesk

Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk

Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API

Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login

Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid

TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has sufficient privileges), would visit the page and the server restart would begin. The attacker must know the full URL that TruDesk is on in order to craft the webpage.

Reflected XSS on ticket filter function in polonel/trudesk

Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function.

Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo

Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk

Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload

Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints

Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs

Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send