CVSS: 9.1EPSS: 1%CPEs: 3EXPL: 0CVE-2020-11431
https://notcve.org/view.php?id=CVE-2020-11431
07 May 2020 — The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbitrary system files and directories on the target server via Directory Traversal. El componente documentation en i-net Clear Reports versiones 16.0 hasta 19.2, HelpDesk versiones 8.0 hasta 8.3 y PDFC versiones 4.3 hasta 6.2, permite a un atacante remoto no autenticado leer archivos y directorios arbitrarios del sistema en el servidor objetivo por medio... • https://www.inetsoftware.de/documentation/clear-reports/release-notes/releases/changes_19.2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 1%CPEs: 1EXPL: 2CVE-2017-18486
https://notcve.org/view.php?id=CVE-2017-18486
09 Aug 2019 — Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user. Jitbit Helpdesk en versiones anteriores... • https://github.com/Kc57/JitBit_Helpdesk_Auth_Bypass • CWE-332: Insufficient Entropy in PRNG •