CVE-2023-1125: Authorization Bypass Through User-Controlled Key

The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own...

CVE-2023-29867

Zammad 5.3.x Fixed 5.4.0 is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API...

CVE-2020-23647

CVE-2020-23647 is a documented XSS vulnerability affecting BoxBilling versions 4.19, 4.19.1, 4.20, and 4.21. The issue arises from the message field on the “submit new ticket” form, allowing remote attackers to execute arbitrary code in some contexts. The available connected sources consistently ...

PT-2023-11652 · Unknown · Boxbilling

Name of the Vulnerable Software and Affected Versions: BoxBilling versions 4.19 through 4.21 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the message field on the submit new ticket form. This enables attackers to execute malicious scripts,...

CVE-2020-23647: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form...

CVE-2020-23647

Cross Site Scripting XSS vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form...

USN-6038-1 golang-1.18 vulnerabilities

It was discovered that the Go net/http module incorrectly handled Transfer-Encoding headers in the HTTP/1 client. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. CVE-2022-1705 It was discovered that Go did not properly manage memory under certain...

alf.io security vulnerability

alf.io is open source ticket reservation system. alfio-event A security vulnerability exists in alf.io versions prior to 2.0-M4-2304, which stems from improper neutralization of formula elements in CSV files...

CVE-2023-2118

Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints...

CVE-2023-2118

Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints...

CVE-2023-2118

Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints...

CVE-2023-2118

CVE-2023-2118 affects Devolutions Server 2023.1.5.0 and earlier. The issue is insufficient access control in the support ticket feature, enabling an authenticated attacker to send support tickets and download diagnostic files through specific endpoints. Impact is described as unauthorized access ...

CVE-2023-2118: Undefined Security Weakness

Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints...

GHSA-M3C3-9QJ7-7XMX Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer

Impact The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user running the servlet engine e.g. tomcat running XWiki. The same vulnerability also allowed to...

Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer

Impact The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user running the servlet engine e.g. tomcat running XWiki. The same vulnerability also allowed to...

Users can set up workflows using restricted and invisible system tags

None...

DEBIAN-CVE-2018-17883

An issue was discovered in Open Ticket Request System OTRS 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS...

UBUNTU-CVE-2018-17883

An issue was discovered in Open Ticket Request System OTRS 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS...

Open Ticket Request System Cross-Site Script Vulnerability

OTRS Open Ticket Request System OTRS is an open source defect tracking and management system software from OTRS Germany. The software categorizes service requests submitted by phone, email and other channels into different queues and service levels, and service personnel use the OTRS system to...

CVE-2018-17883

An issue was discovered in Open Ticket Request System OTRS 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS...