Spiceworks

Spiceworks

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2020-25901

Exploit
  • EPSS 2.3%
  • Veröffentlicht 18.12.2020 15:15:12
  • Zuletzt bearbeitet 21.11.2024 05:18:58

Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.

8.8

CVE-2020-23451

Exploit
  • EPSS 0.15%
  • Veröffentlicht 15.09.2020 14:15:14
  • Zuletzt bearbeitet 21.11.2024 05:13:49

Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function.

5.4

CVE-2020-23450

Exploit
  • EPSS 0.43%
  • Veröffentlicht 01.09.2020 16:15:12
  • Zuletzt bearbeitet 21.11.2024 05:13:48

Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/inventory/groups/ without output sanitization.

9.8

CVE-2017-7237

Exploit
  • EPSS 13.2%
  • Veröffentlicht 06.04.2017 15:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by leveraging the unauthenticated nature of the TFTP service for all clients who can reach UDP po...

6.5

CVE-2012-2956

Exploit
  • EPSS 0.94%
  • Veröffentlicht 17.09.2014 15:55:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2.json. NOTE: this entry was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6658 is f...

4.3

CVE-2012-6658

Exploit
  • EPSS 1.45%
  • Veröffentlicht 17.09.2014 15:55:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName configuration in snmpd.conf. NOTE: this entry was SPLIT...

3.5

CVE-2014-3740

Exploit
  • EPSS 2.98%
  • Veröffentlicht 11.09.2014 18:55:05
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page.