Overview 124 matches · 2 in Waratek scope · 1 protected · 5 exploited · 1 CISA KEV · 40 public PoC · 1 EPSS ≥ 0.5
124matches
2in Waratek scope1.6%
1protected0.8%
5exploited4.0%
1CISA KEV0.8%
40public PoC32.3%
1EPSS ≥ 0.50.8%
Protected by Waratek
1
0.8%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.8%
Outside Waratek scope
0
0.0%
Not applicable
122
98.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.8%
partly blocked
0
0.0%
not blocked
123
99.2%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 14 / year
20022
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20032
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20043
Not applicable3
High2
Medium1
not blocked3
Working exploit published3
20059
Not applicable9
High4
Medium5
not blocked9
Working exploit published4
No public exploit5
200611
Not applicable11
High5
Medium6
not blocked11
Working exploit published8
No public exploit3
200711
Not applicable11
High5
Medium6
not blocked11
Working exploit published4
No public exploit7
20081
Not applicable1
Medium1
not blocked1
Working exploit published1
20095
Not applicable5
High2
Medium3
not blocked5
Working exploit published3
No public exploit2
20104
Not applicable4
High1
Medium3
not blocked4
Working exploit published4
20112
Not applicable2
Medium2
not blocked2
No public exploit2
20120
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20140
20150
20160
201714
Not applicable14
Critical2
High8
Medium4
not blocked14
Exploited2
Working exploit published8
No public exploit4
20183
Not applicable3
Critical1
Medium2
not blocked3
No public exploit3
20192
Not applicable2
High2
not blocked2
No public exploit2
202011
Not applicable11
Critical3
High2
Medium6
not blocked11
No public exploit11
20217
Not applicable7
Critical3
High1
Medium3
not blocked7
Exploited3
No public exploit4
20225
No exploit published1
Not applicable4
High1
Medium4
not blocked5
No public exploit5
20238
Protected by Waratek1
Not applicable7
Critical1
High5
Medium2
blocked by ARMR today1
not blocked7
Proof of concept only2
No public exploit6
20244
Not applicable4
High2
Medium2
not blocked4
Proof of concept only1
No public exploit3
202514
Not applicable14
High8
Medium6
not blocked14
Proof of concept only3
No public exploit11
20265
Not applicable5
Medium5
not blocked5
No public exploit5
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2006-6158 | Medium | 2006-11-28 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in (a) PMOS Help Desk 2.4, formerly (b) InverseFlow Help Desk 2.31 and also sold as (c) Ace Helpdesk 2.31, allow remote attackers to inject arbitrary web script or HTML via the (1) id or email parameter to ticketview.php, or (2) the email parameter to ticket.php. |
| CVE-2006-5951 | High | 2006-11-17 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter. |
| CVE-2006-5474 | High | 2006-10-24 | Not applicable | No public exploit | The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset. |
| CVE-2006-5428 | Medium | 2006-10-20 | Not applicable | Working exploit published | rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information (ticket data) via a direct request. |
| CVE-2006-4539 | High | 2006-09-05 | Not applicable | No public exploit | (1) includes/widgets/module_company_tickets.php and (2) includes/widgets/module_track_tickets.php Client Support Center in Cerberus Helpdesk 3.2 Build 317, and possibly earlier, allows remote attackers to bypass security restrictions and obtain sensitive information via the ticket parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. |
| CVE-2006-3930 | High | 2006-07-31 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in admin.a6mambohelpdesk.php in a6mambohelpdesk Mambo Component 18RC1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter. |
| CVE-2006-2990 | Medium | 2006-06-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in default.asp in VanillaSoft Helpdesk 2005 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter. |
| CVE-2006-0509 | Medium | 2006-02-01 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in clients.php in Cerberus Helpdesk, possibly 2.7, allow remote attackers to inject arbitrary web script or HTML via (1) the contact_search parameter and (2) unspecified url fields. |
| CVE-2005-4628 | High | 2005-12-31 | Not applicable | No public exploit | SQL injection vulnerability in index.php in HelpDeskPoint 2.38 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. |
| CVE-2005-4428 | Medium | 2005-12-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in Cerberus Helpdesk allows remote attackers to inject arbitrary web script or HTML via the kb_ask parameter. |
| CVE-2005-4427 | High | 2005-12-20 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) file_id parameter to attachment_send.php, (2) the $addy variable in email_parser.php, (3) $address variable in email_parser.php, (4) $a_address variable in structs.php, (5) kbid parameter to cer_KnowledgebaseHandler.class.php, (6) queues[] parameter to addresses_export.php, (7) $thread variable to display.php, (8) ticket parameter to display_ticket_thread.php. |
| CVE-2005-4285 | Medium | 2005-12-16 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in pdestore.cgi in Dick Copits PDEstore 1.8 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) the search module parameter or the (2) product and (3) cart_id parameters. |
| CVE-2005-3925 | High | 2005-11-30 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Central Manchester CLC Helpdesk Issue Manager 0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) detail[], (2) orderdir, and (3) orderby parameters to find.php, and the (4) id parameter to issue.php. |
| CVE-2005-3826 | High | 2005-11-26 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Ezyhelpdesk 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) edit_id, (2) faq_id, and (3) c_id parameters in a query string, and (4) the search engine, possibly involving the search_string parameter. |
| CVE-2005-3502 | Medium | 2005-11-05 | Not applicable | No public exploit | attachment_send.php in Cerberus Helpdesk allows remote attackers to view attachments and tickets of other users via a modified file_id parameter. |
| CVE-2005-1963 | Medium | 2005-06-16 | Not applicable | No public exploit | Cerberus Helpdesk 0.97.3 allows remote attackers to obtain sensitive information via certain requests to (1) reports.php, (2) knowledgebase.php, or (3) configuration.php, which leaks the information in a PHP error message. |
| CVE-2005-1962 | Medium | 2005-06-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Cerberus Helpdesk 0.97.3 allows remote attackers to inject arbitrary web script or HTML via the (1) errorcode parameter to index.php or (2) certain fields to clients.php. |
| CVE-2004-2737 | High | 2004-12-31 | Not applicable | Working exploit published | SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter. |
| CVE-2004-2736 | Medium | 2004-12-31 | Not applicable | Working exploit published | Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie. |
| CVE-2004-2562 | High | 2004-12-31 | Not applicable | Working exploit published | SQL injection vulnerability in jobedit.asp in Leigh Business Enterprises (LBE) Web Helpdesk before 4.0.0.81 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2003-0304 | High | 2003-06-09 | Not applicable | Working exploit published | one||zero (aka One or Zero) Helpdesk 1.4 rc4 allows remote attackers to create administrator accounts by directly calling the install.php Helpdesk Installation script. |
| CVE-2003-0303 | Medium | 2003-06-09 | Not applicable | Working exploit published | SQL injection vulnerability in one||zero (aka One or Zero) Helpdesk 1.4 rc4 allows remote attackers to modify arbitrary ticket number descriptions via the sg parameter. |
| CVE-2002-0932 | Medium | 2002-10-04 | Not applicable | Working exploit published | SQL injection vulnerability in index.php for MyHelpDesk 20020509, and possibly other versions, allows remote attackers to conduct unauthorized activities via SQL code in the "id" parameter for the operations (1) detailticket, (2) editticket, or (3) updateticketlog. |
| CVE-2002-0931 | High | 2002-10-04 | Not applicable | Working exploit published | Cross-site scripting vulnerabilities in MyHelpDesk 20020509, and possibly other versions, allows remote attackers to execute script as other users via a (1) Title or (2) Description when a new ticket is created by a support assistant, via the "id" parameter to the index.php script with the (3) tickettime, (4) ticketfiles, or (5) updateticketlog operations, or (6) via the update section when a ticket is edited. |