uvdesk records
5 published records for vendor uvdesk.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 20%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-269 Improper Privilege Management1
- CWE-307 Improper Restriction of Excessive Authentication Attempts1
- CWE-434 Unrestricted Upload of File with Dangerous Type1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
39Monitor | CVE-2023-37635Proof of concept | UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the appuvdesk · community-skeleton · CWE-307 | Critical9.8 | 1.3%Oct 23, 2023 |
35Monitor | CVE-2023-0265No exploit | Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server.uvdesk · community-skeleton · CWE-434 | High8.8 | 1.6%Apr 4, 2023 |
28Monitor | CVE-2024-3137No exploit | Improper Privilege Management in uvdesk/community-skeletonuvdesk · uvdesk/community-skeleton · CWE-269 | High7.1 | 0.3%Apr 1, 2024 |
24Monitor | CVE-2023-0325No exploit | Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application.uvdesk · community-skeleton · CWE-79 | Medium6.1 | 0.6%Apr 4, 2023 |
19Monitor | CVE-2023-1197No exploit | Cross-site Scripting (XSS) - Stored in uvdesk/community-skeletonuvdesk · community-skeleton · CWE-79 | Medium4.8 | 0.3%Mar 6, 2023 |
- CVE-2023-3763539Monitor
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the app
CriticalCVSS 9.8Proof of conceptEPSS 1%uvdesk · community-skeletonOct 23, 2023
- CVE-2023-026535Monitor
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server.
HighCVSS 8.8No exploitEPSS 1%uvdesk · community-skeletonApr 4, 2023
- CVE-2024-313728Monitor
Improper Privilege Management in uvdesk/community-skeleton
HighCVSS 7.1No exploitEPSS 0%uvdesk · uvdesk/community-skeletonApr 1, 2024
- CVE-2023-032524Monitor
Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application.
MediumCVSS 6.1No exploitEPSS 0%uvdesk · community-skeletonApr 4, 2023
- CVE-2023-119719Monitor
Cross-site Scripting (XSS) - Stored in uvdesk/community-skeleton
MediumCVSS 4.8No exploitEPSS 0%uvdesk · community-skeletonMar 6, 2023