CVE-2018-8720

ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile aka navpage.do, or the Search bar of My Portal aka searchresults.do...

CVE-2018-8720

The vulnerability CVE-2018-8720 affects ServiceNow ITSM 2016-06-02 . A cross-site scripting (XSS) flaw exists in the web interface via the First Name/Last Name fields in My Profile (navpage.do) or the Search bar in My Portal (search_results.do) . Publicly documented entries (NVD, CNVD, CVE lists)...

CVE-2018-8720: Improper Neutralization of Input During Web Page Generation

ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile aka navpage.do, or the Search bar of My Portal aka searchresults.do...

PT-2018-18598

Name of the Vulnerable Software and Affected Versions ServiceNow ITSM version 2016-06-02 Description The issue concerns a cross-site scripting XSS problem. It can be triggered via the First Name or Last Name field of My Profile, or the Search bar of My Portal. Recommendations For version...

openSUSE Security Update : otrs (openSUSE-2016-1316)

This update for otrs fixes the following security issues : - CVE-2016-9139: execution of JavaScript in OTRS context by opening malicious attachment OSA-2016-02, bsc1008017 In addition, OTRS was updated to 3.3.16, containing all upstream improvements and bug fixes. %NASLMINLEVEL 70300 C Tenable...

ServiceNow ITSM Cross Site Scripting

Overview----------------------------------------------------------------------------------------------------------------------- Vendor: ServiceNow Vulnerable Product: ServiceNow IT Service Management ITSM Vulnerability Type: Multiple Cross Site Scripting Vulnerability Vendor Homepage:...

ManageEngine ServiceDesk Plus 9.1 Build 9110 Path Traversal

Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use capability, ServiceDesk Plus helps IT support teams deliver world-class...

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use...

SysAid Help Desk 14.4 Code Execution / Denial Of Service / Traversal / SQL Injection

Hi, tl;dr Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they all have been fixed in 15.2, but no re-test was performed. Full advisory below, and a copy can be obtained at 1. 5 Metasploit modules have been released and currently awaiting merge in the moderati...

BMC Track-It! - Multiple Vulnerabilities

No description provided by source. Multiple critical vulnerabilities in BMC Track-It! Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= The application exposes several .NET remoting services o...

OTRS FAQ Module - Persistent XSS

No description provided by source. Exploit Title: OTRS Faq Module - Persistent XSS Date: 2-Apr-2013 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.otrs.com Version: OTRS ITSM 3.2.x,OTRS ITSM 3.1.x,OTRS ITSM 3.0.x Tested on: Perl CVE : CVE-2013-2637 OVERVIEW The OTRS ITSM FAQ Module 3.2...

Hornbill Supportworks ITSM 1.0.0 - SQL Injection Vulnerability

No description provided by source. Summary SQL Injection Vulnerability in ITSM component of Hornbill Supportworks Application CVE number: CVE-2013-2594 Impact: High Vendor homepage: http://www.hornbill.com Vendor notified: 19/11/2012 Vendor response: This issue has reportedly been fixed but the...

openSUSE Security Update : otrs (openSUSE-SU-2014:0561-1)

This otrs update fixes the following security and non security issues : - bnc871758: Fixed OSA-2014-04 CVE-2014-2553 and OSA-2014-05 CVE-2014-2554. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

openSUSE Security Update : otrs (openSUSE-SU-2011:0464-1)

This updated fixes a cross site scripting XSS issue in otrs. CVE-2011-1518 Upstream advisory: http://otrs.org/advisory/OSA-2011-01-en/ %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update otrs-4509...

PT-2021-8375

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS ITSM versions 3.0.x through 3.0.8 Open Ticket Request System OTRS ITSM versions 3.1.x through 3.1.9 Open Ticket Request System OTRS ITSM versions 3.2.x through 3.2.6 Description A cross-site scripting XSS issue...

CVE-2013-2594

SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote attackers to execute arbitrary SQL commands via the callref parameter...

Sql injection

SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote attackers to execute arbitrary SQL commands via the callref parameter...

CVE-2013-2594

The CVE-2013-2594 issue is a SQL injection in Hornbill Supportworks ITSM, affecting the reports/calldiary.php endpoint. Exploitation via the callref parameter could allow remote attackers to inject arbitrary SQL and, per multiple sources, may lead to full control of the host (e.g., writing a webs...

CVE-2013-2594

SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote attackers to execute arbitrary SQL commands via the callref parameter...

PT-2014-2596

Name of the Vulnerable Software and Affected Versions Hornbill Supportworks ITSM versions 1.0.0 through 3.4.14 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the callref parameter in the reports/calldiary.php file. Recommendations For version...