85 matches found
openSUSE Security Update : otrs (openSUSE-SU-2010:0366-1)
OTRS was prone to multiple SQL-injection vulnerabilities which could allow remote authenticated attackers to execute arbitrary SQL code via unspecified vectors.CVE-2010-0438. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...
openSUSE Security Update : otrs (openSUSE-SU-2010:0366-1)
OTRS was prone to multiple SQL-injection vulnerabilities which could allow remote authenticated attackers to execute arbitrary SQL code via unspecified vectors.CVE-2010-0438. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...
Debian DSA-1993-1 : otrs2 - sql injection
It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise input data that is used on SQL queries, which might be used to inject arbitrary SQL to, for example, escalate privileges on a system that uses otrs2. The oldstable distribution etch is not affected...
OTRS Multiple SQLi Vulnerabilities (OSA-2010-01)
Open Ticket Request System OTRS is prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
[SECURITY] [DSA 1993-1] New otrs2 packages fix SQL injection
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1993-1 [email protected] http://www.debian.org/security/ Raphael Geissert February 10, 2010 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1993-1] New otrs2 packages fix SQL injection
------------------------------------------------------------------------ Debian Security Advisory DSA-1993-1 [email protected] http://www.debian.org/security/ Raphael Geissert February 10, 2010 http://www.debian.org/security/faq -...
FreeBSD Ports: otrs
The remote host is missing an update to the system as announced in the referenced advisory. VID 6b575419-14cf-11df-a628-001517351c22 OpenVAS Vulnerability Test $ Description: Auto generated from VID 6b575419-14cf-11df-a628-001517351c22 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...
CVE-2010-0438
CVE-2010-0438 concerns multiple SQL injections in OTRS by failing to sanitise input in Kernel/System/Ticket.pm. Affected are OTRS Core versions: 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7. The vulnerability allows remote authenticated users to execute arbit...
CVE-2009-0438
IBM WebSphere Application Server 7 on Windows is affected by CVE-2009-0438: WAS 7 before 7.0.0.1 allows remote attackers to bypass Authorization and view data from JSP pages via a crafted request. This is noted as a probable duplicate of CVE-2008-5412. The connected records also describe the unde...
CVE-2009-0438
IBM WebSphere Application Server WAS 7 before 7.0.0.1 on Windows allows remote attackers to bypass "Authorization checking" and obtain sensitive information from JSP pages via a crafted request. NOTE: this is probably a duplicate of CVE-2008-5412...
Code injection
Unspecified vulnerability in IBM WebSphere Application Server WAS 7 before 7.0.0.1 on Windows has unknown impact and attack vectors related to JSPs. NOTE: this is probably a duplicate of CVE-2009-0438...
CVE-2008-5412
IBM WebSphere Application Server 7 (Windows) is affected by CVE-2008-5412/CVE-2009-0438, where WAS 7 before 7.0.0.1 allows remote attackers to bypass authorization and read sensitive data from JSPs via a crafted request. The issue is described as unspecified in the 2008 entry, with later sources ...
FreeBSD Ports: awstats
The remote host is missing an update to the system as announced in the referenced advisory. VID fdad8a87-7f94-11d9-a9e7-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
CVE-2006-0438
Cross-site request forgery CSRF vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode IMG are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to 1 admin/adminusers.php and 2...
CVE-2006-0438
CVE-2006-0438 is a CSRF vulnerability in phpBB 2.0.19 where enabling Link to off-site Avatar or bbcode (IMG) allows an attacker to perform actions as a logged-in user via a link or image in a profile (e.g., admin/admin_users.php, modcp.php). The NVD entry lists a CVSSv2 base score of 5.0 (Medium)...
CVE-2005-0438
CVE-2005-0438 affects AWStats awstats.pl (versions 6.3 and 6.4); improper handling of the debug parameter allows remote disclosure of sensitive information. Connected sources (NVD, Debian/OpenVAS/Nessus advisories) confirm a vulnerability with updates/missing input sanitization themes, but explic...
CVE-2003-0438
CVE-2003-0438 concerns the eldav WebDAV client for Emacs (versions 0.7.2 and earlier). Affected component is the client itself, where a symlink attack on temporary files allows a local user to create or overwrite arbitrary files with the privileges of the user running Emacs/eldav. The vulnerabili...
CVE-2003-0438
eldav WebDAV client for Emacs, version 0.7.2 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files...
CVE-2002-0438
CVE-2002-0438 affects ZyXEL ZyWALL 10; firmware versions before 3.50 are vulnerable to a crafted ARP packet using the firewall’s IP and a malformed MAC, causing the firewall to disable its LAN interface (DoS). The referenced fix is a ZyWALL 10 firmware update to 3.50 (or newer). If exploitation d...
