Debian DSA-3876-1 : otrs2 - security update

Joerg-Thomas Vogt discovered that the SecureMode was insufficiently validated in the OTRS ticket system, which could allow agents to escalate their privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

PT-2017-18844

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 3.3.x through 3.3.16 Open Ticket Request System OTRS versions 4.x through 4.0.23 Open Ticket Request System OTRS versions 5.x through 5.0.19 Description An issue allows an attacker with agent permission...

Evolution Script CMS Cross-Site Scripting Vulnerability

Evolution Script is managed by a team of professionals specializing in pay-per-click software development. A cross-site scripting vulnerability exists in the "status" parameter of the "Ticket Support" module of Evolution Script CMS version 5.3, which can be exploited by remote attackers to inject...

OTRS Install Dialog Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2017-018 Product: OTRS Manufacturer: OTRS Affected Versions: OTRS 5.0.x, OTRS 4.0.x, OTRS 3.3.x Fixed Versions: OTRS 5.0.20, OTRS 4.0.24, OTRS 3.3.17 Tested Versions: 5.0.19 Vulnerability Type: Access to Installation Dialog Risk...

Evolution Script CMS v5.3 - Cross Site Scripting Vulnerability

Document Title: =============== Evolution Script CMS v5.3 - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2075 Release Date: ============= 2017-06-07 Vulnerability Laboratory ID VL-ID:...

Evolution Script CMS v5.3 - Cross Site Scripting Vulnerability

Document Title: =============== Evolution Script CMS v5.3 - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2075 Release Date: ============= 2017-06-06 Vulnerability Laboratory ID VL-ID:...

Open Ticket Request System Cross-Site Scripting Vulnerability

Open Ticket Request System OTRS is an open source defect tracking and management system software from the German OTRS Group. The software categorizes service requests submitted through various channels such as phone calls, emails, etc. into different queues and service levels, and the service...

Design/Logic Flaw

Open Ticket Request System OTRS 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=XSS and Direction=XSS attacks. NOTE: this CVE may have limited relevance because it represents a 2017 discovery of an issue in software from 2014. The 3.3.20 release, for example, is n...

CVE-2017-9299

CVE-2017-9299 concerns Open Ticket Request System (OTRS) 3.3.9 with a cross-site scripting vulnerability in the web interface. The vulnerable vector is the index.pl?Action=AgentStats requests, exploitable via crafted OrderBy and Direction parameters to inject script or HTML. The vulnerability is ...

PT-2017-18831

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.3.20 Description The issue concerns a Cross-Site Scripting XSS attack. Specifically, it affects index.pl requests with the Action=AgentStats parameter. The vulnerability can be exploited...

Design/Logic Flaw

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...

CVE-2014-3527

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...

CVE-2014-3527

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...

CVE-2014-3527

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...

CVE-2014-3527

The CVE-2014-3527 issue affects Spring Security’s CAS Proxy ticket authentication (versions 3.1 to 3.2.4). The root cause is that the proxy ticket authentication relies on HttpServletRequest data that can be populated from untrusted information, enabling a malicious CAS service to bypass access c...

CVE-2014-3527

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...

CVE-2014-3527: Improper Authentication

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...

PT-2017-5875

Name of the Vulnerable Software and Affected Versions: Spring Security versions 3.1 through 3.2.4 Description: A malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated, due to the proxy ticket authentication using information from the...

Secure Mail : Error Processing STA Ticket. Bad Request, Cannot Connect to Company Network

Cannot connect to company network and Error Processing STA Ticket. Bad Request. Seems to be happening when entering passcode. NetScalers went down due to network trouble between datacenters...

ALPINE-CVE-2016-2126

Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC Privilege Attribute Certificate checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the...