275 matches found
WordPress plugin YDS Support Ticket System 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
PT-2022-23347 · Unknown · Yds Support Ticket System
Name of the Vulnerable Software and Affected Versions: YDS Support Ticket System plugin versions = 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on the web...
YDS Support Ticket System <= 1.0 - Cross-Site Request Forgery
The plugin does not have CSRF check in some places, which could allow attackers to make logged in users perform unwanted actions...
WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability discovered by ptsfence Patchstack Alliance in WordPress YDS Support Ticket System plugin versions = 1.0. Solution No patched version is available. No reply from the vendor...
Missing brute force protection on cloud federation sharing
None...
Fluent Support < 1.5.8 - Admin+ SQLi
The plugin does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users With at least one support ticket in the system:...
Ownership check missing when updating or deleting mail attachments
None...
Rundeck's Key Storage converter plugin mechanism's encryption layer not working in 4.2.0, 4.2.1, 4.3.0
Impact The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created or overwritten using Rundeck 4.2.0 or 4.2.1 might result in them being written in plaintex...
HelpDeskZ cross-site scripting vulnerability (CNVD-2022-59046)
HelpDeskZ is a PHP-based software that allows you to manage your site's support using a web-based support ticket system. Provides quality support. A cross-site scripting vulnerability exists in HelpDeskZ version v2.0.2, which stems from a lack of parameter filtering and escaping in...
Improper input-size validation on the user new session name
None...
Sensitive files/ data exists post deletion of user account
None...
Error in deleting deck cards attachment reveals the full application path
None...
Force an admin to install recommended applications
None...
Control character filtering misses leading and trailing whitespace in file and folder names
None...
Command Injection in Appointment Emails for Calendar
None...
High memory usage for generating preview of broken image
None...
Geolocation preview links can be set to arbitrary links
None...
WordPress HelpDesk & Support Ticket System Plugin – Octrace Support plugin <= 1.2.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress HelpDesk & Support Ticket System Plugin – Octrace Support plugin versions = 1.2.2. Solution Update the WordPress HelpDesk & Support Ticket System Plugin – Octrace Support plugin to the latest available...
WordPress HelpDesk & Support Ticket System Plugin – Octrace Support plugin <= 1.2.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress HelpDesk & Support Ticket System Plugin – Octrace Support plugin versions = 1.2.2. Solution Update the WordPress HelpDesk & Support Ticket System Plugin – Octrace Support plugin to the latest available version at least 1.2.3...