Vsdesk
Monthly
OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary operating system commands on the underlying server due to insufficient input filtering. Affecting at least vsDesk 11.06.02, the flaw - discovered and reported by Kaspersky - can be leveraged to disrupt web server operations, exfiltrate sensitive data, or achieve full server compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires high-privilege authenticated access, which meaningfully constrains opportunistic attack scenarios.
File enumeration in vsDesk service desk software allows remote authenticated attackers to predict and retrieve uploaded files by brute-forcing timestamp-derived filenames within a narrow time window. Affected instances running versions prior to 14.0101 expose any uploaded document to unauthorized access by any logged-in user, enabling secondary attacks through sensitive file exfiltration. No public exploit code has been identified at the time of analysis, and no CISA KEV listing exists.
Unauthenticated administrative account takeover in vsDesk (a Russian-market IT service-desk/help-desk platform) lets a remote attacker abuse insecure deserialization of application configuration data to point the login flow at an attacker-controlled LDAP server and provision a new admin account. Rated CVSS 4.0 9.3 (critical) with an unauthenticated network vector, it was researched and disclosed by Kaspersky (klsecservices); a detailed public write-up exists (KLSA-00296), though no CISA KEV listing or confirmed weaponized exploit is present in the data, so this is best characterized as no public exploit code identified at time of analysis despite a thorough advisory.
Blind SQL injection in vsDesk (vsdesk.ru) exposes database contents and can render the application unresponsive via unauthenticated network requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote exploitation requiring no privileges or user interaction, with high confidentiality and availability impact. No active exploitation or public proof-of-concept has been identified at time of analysis; a vendor-released patch is available in version 14.0101 and later.
OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary operating system commands on the underlying server due to insufficient input filtering. Affecting at least vsDesk 11.06.02, the flaw - discovered and reported by Kaspersky - can be leveraged to disrupt web server operations, exfiltrate sensitive data, or achieve full server compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires high-privilege authenticated access, which meaningfully constrains opportunistic attack scenarios.
File enumeration in vsDesk service desk software allows remote authenticated attackers to predict and retrieve uploaded files by brute-forcing timestamp-derived filenames within a narrow time window. Affected instances running versions prior to 14.0101 expose any uploaded document to unauthorized access by any logged-in user, enabling secondary attacks through sensitive file exfiltration. No public exploit code has been identified at the time of analysis, and no CISA KEV listing exists.
Unauthenticated administrative account takeover in vsDesk (a Russian-market IT service-desk/help-desk platform) lets a remote attacker abuse insecure deserialization of application configuration data to point the login flow at an attacker-controlled LDAP server and provision a new admin account. Rated CVSS 4.0 9.3 (critical) with an unauthenticated network vector, it was researched and disclosed by Kaspersky (klsecservices); a detailed public write-up exists (KLSA-00296), though no CISA KEV listing or confirmed weaponized exploit is present in the data, so this is best characterized as no public exploit code identified at time of analysis despite a thorough advisory.
Blind SQL injection in vsDesk (vsdesk.ru) exposes database contents and can render the application unresponsive via unauthenticated network requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote exploitation requiring no privileges or user interaction, with high confidentiality and availability impact. No active exploitation or public proof-of-concept has been identified at time of analysis; a vendor-released patch is available in version 14.0101 and later.