5744 matches found
Improper Privilege Management API V2
Description There are some api v2 doesn't check permission allow attackers to retrieve/edit information ticket,account,group,department,team,ElasticSearch Proof of Concept Get users list 1. Login. 2. Go to /api/v2/accounts?type=all. 3. Users list return. Create user with admin role 1. Get the adm...
CVE-2022-29317
Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/handleLogin.php...
CVE-2022-29317
Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/handleLogin.php...
CVE-2022-29317
Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/handleLogin.php...
Sql injection
Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/handleLogin.php...
CVE-2022-29317
Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/handleLogin.php...
CVE-2022-29317
The CVE-2022-29317 entry concerns Simple Bus Ticket Booking System v1.0. Connected sources confirm SQL injection vulnerabilities in the login flow, specifically via the username and password parameters handled by /assets/partials/_handleLogin.php. The root cause, as described across multiple data...
CVE-2022-29317: Improper Neutralization of Special Elements used in an SQL Command
Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/handleLogin.php...
PT-2022-19535
Name of the Vulnerable Software and Affected Versions Simple Bus Ticket Booking System version 1.0 Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities exist via the username and password parameters at the "/assets/partials/ handleLogin.php" API endpoint...
Reflected XSS on ticket filter function
Description Ticket management filter in Trudesk v1.2.0 allow user to perform XSS due to improper validation on filter attribute such as "status", "ticket type", "assignee" and etc. Proof of Concept 1 Login to Trudesk with role user privilege 2 Tickets - Filter ticket 3 Filter for ticket status po...
Zammad Denial of Service Vulnerability (CNVD-2022-70098)
Zammad is a suite of ticket management software from Zammad Germany. v5.1.0 of Zammad suffers from a denial of service vulnerability that stems from a lack of rate limiting in the forgot password feature, which could be exploited by an attacker to potentially cause a denial of service DoS via a...
Zammad Denial of Service Vulnerability (CNVD-2022-70097)
Zammad is a suite of ticket management software from Zammad Germany. v5.1.0 of Zammad suffers from a denial of service vulnerability that stems from a lack of a password length limit allowing the creation of extremely long passwords, which could be exploited by an attacker to cause a denial of...
Force an admin to install recommended applications
None...
Control character filtering misses leading and trailing whitespace in file and folder names
None...
CVE-2022-24869
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack...
CVE-2022-24869: Improper Neutralization of Input During Web Page Generation
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack...
OpenSSL TLS Decrypt Ticket DoS
The vulnerability of the tlsdecryptticket function in the OpenSSL library exists due to insufficient validation of input data. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...
Slackware: Security Advisory (SSA:2020-155-01)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OTRS Ticket Request System Information Disclosure
The vulnerability of the OTRS ticket request system is related to the disclosure of information. Exploiting this vulnerability allows a malicious actor, who operates remotely, to gain access to confidential data...