https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-45176.htmlhttps://patchthecve.com/cve/CVE-2022-45176.htmlWed, 17 Jun 2026 05:09:33 +0000MEDIUM 5.4: An issue was discovered in LIVEBOX Collaboration vDesk through v018. Stored Cross-site Scripting (XSS) can occur under the /api/v1/getbodyfile endpoint via the uri parameter. The web application (through its vShare functionality section) doesn't properly check parameters, sent in HTTP requests as inhttps://patchthecve.com/cve/CVE-2022-45168.htmlhttps://patchthecve.com/cve/CVE-2022-45168.htmlWed, 17 Jun 2026 05:09:30 +0000MEDIUM 6.5: An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/createbackupcodes endpoint, because the application allows a user to generate or regenerate the backup codes befhttps://patchthecve.com/cve/CVE-2022-45171.htmlhttps://patchthecve.com/cve/CVE-2022-45171.htmlWed, 17 Jun 2026 05:09:32 +0000HIGH 8.8: An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site section. A remote user, authenticated to the product, can arbitrarily upload potentially dangerous files without restrictions.https://patchthecve.com/cve/CVE-2022-45179.htmlhttps://patchthecve.com/cve/CVE-2022-45179.htmlWed, 17 Jun 2026 05:09:34 +0000MEDIUM 5.4: An issue was discovered in LIVEBOX Collaboration vDesk through v031. A basic XSS vulnerability exists under the /api/v1/vdeskintegration/todo/createorupdate endpoint via the title parameter and /dashboard/reminders. A remote user (authenticated to the product) can store arbitrary HTML code in the rehttps://patchthecve.com/cve/CVE-2022-45177.htmlhttps://patchthecve.com/cve/CVE-2022-45177.htmlWed, 17 Jun 2026 05:09:33 +0000HIGH 7.5: An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isenableuser endpoint, the /api/v1/sharedsearch?search={NAME]+{SURNAME] endpoint, and the /login endpoint. The web application provides different https://patchthecve.com/cve/CVE-2022-45169.htmlhttps://patchthecve.com/cve/CVE-2022-45169.htmlWed, 17 Jun 2026 05:09:31 +0000MEDIUM 5.4: An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site (Open Redirect) can occur under the /api/v1/notification/createnotification endpoint, allowing an authenticated user to send an arbitrary push notification to any other user of the system. Thi