CVE-2006-6158

CVE-2006-6158 affects PMOS Help Desk 2.4 (aka InverseFlow Help Desk 2.31, sold as Ace Helpdesk 2.31). The vulnerability is multiple cross-site scripting (XSS) that allows remote attackers to inject arbitrary web script or HTML via: (1) the id or email parameter to ticketview.php, or (2) the email...

CVE-2006-6158: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in a PMOS Help Desk 2.4, formerly b InverseFlow Help Desk 2.31 and also sold as c Ace Helpdesk 2.31, allow remote attackers to inject arbitrary web script or HTML via the 1 id or email parameter to ticketview.php, or 2 the email parameter to...

PMOS Help Desk 2.3 - ticketview.php Multiple Cross-Site Scripting Vulnerabilities

PMOS Help Desk 2.3 - ticketview.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/21250/info InverseFlow Help Desk is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage these issues to have arbitrary script code execute in th...

PMOS Help Desk 2.3 - ticket.php?email Cross-Site Scripting

PMOS Help Desk 2.3 - ticket.php?email Cross-Site Scripting source: https://www.securityfocus.com/bid/21250/info InverseFlow Help Desk is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...

PMOS Help Desk 2.3 - 'ticket.php?email' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21250/info InverseFlow Help Desk is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may he...

OneOrZero Helpdesk以不安全方式生成口令漏洞

OneOrZero Helpdesk是一个PHP/MySQL帮助桌面软件。 OneOrZero生成访问口令的方式上存在漏洞，攻击者可以利用此漏洞推测出自动生成的口令。 OneOrZero的forgot password函数会在回答完安全问题后重置口令，默认下这个口令为空。用户可以通过重置管理员口令并保持回答为空强制重置口令。但是，由于口令重置函数是基于用户名和服务器时间来设置口令的，因此可以通过服务器的时间来判断所设置的口令。 OneOrZero OneOrZero 1.6.0 - 1.6.4 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2006-5474

The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset...

CVE-2006-5474

The CVE-2006-5474 entry concerns OneOrZero Helpdesk versions before 1.6.5.4. Root cause: the forgot-password function generates passwords by concatenating the current timestamp with the username, enabling remote attackers to gain access to an arbitrary user via a password reset request. Impact: u...

CVE-2006-5474: Undefined Security Weakness

The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset...

Advisory for Oneorzero helpdesk

Permanant Link : http://www.whitedust.net/speaks/3043/ ------------------------------------------------------------ - Advisory for OneOrZero Helpdesk - ------------------------------------------------------------ - OneOrZero Helpdesk - AFFECTED PRODUCTS ================= OneOrZero Helpdesk v1.6.0...

Cerberus Helpdesk rpc.php Information Disclosure

Binary data 3797.prm...

CVE-2006-5428

rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a displaygetrequesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information ticket data via a direct request...

CVE-2006-5428

rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a displaygetrequesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information ticket data via a direct request...

CVE-2006-5428

CVE-2006-5428 : Cerberus Helpdesk 3.2.1 contains an information-disclosure flaw in rpc.php where it does not verify a client’s privileges for display_get_requesters. This allows an unauthenticated or improperly authenticated user to bypass the GUI login and directly retrieve sensitive ticket data...

CVE-2006-5428: Undefined Security Weakness

rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a displaygetrequesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information ticket data via a direct request...

Cerberus Helpdesk rpc.php Arbitrary Ticket Information Disclosure

The remote host is running Cerberus Helpdesk, a web-based helpdesk suite written in PHP. The installed version of Cerberus Helpdesk on the remote host allows an unauthenticated attacker to retrieve information about ticket requesters through the 'rpc.php' script. %NASLMINLEVEL 70300 C Tenable...

Cerberus Helpdesk 3.2.1 - 'Rpc.php' Unauthorized Access

source: https://www.securityfocus.com/bid/20598/info Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to authenticate users properly, resulting in an improper-access validation. A workaround is available. An attacker can exploit this vulnerability t...

Cerberus Helpdesk 3.2.1 - Rpc.php Unauthorized Access

Cerberus Helpdesk 3.2.1 - Rpc.php Unauthorized Access source: https://www.securityfocus.com/bid/20598/info Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to authenticate users properly, resulting in an improper-access validation. A workaround is...

CVE-2006-5101

CVE-2006-5101 is a PHP remote file inclusion vulnerability in Comdev CSV Importer 3.1 (and possibly 4.1) used across multiple Comdev components (Contact Form, Helpdesk, Events Calendar, FAQ/Support, Guestbook, Links Directory, News Publisher, Newsletter, Photo Gallery, Vote Caster, Web Blogger, e...

Comdev Customer Helpdesk 3.1 :) <= Remote File Inclusion

+-------------------------------------------------------------------- + + Comdev Customer Helpdesk 3.1 : = Remote File Inclusion + +-------------------------------------------------------------------- + + Affected Software .: Comdev Customer Helpdesk 3.1 + Venedor ...........:...