2164 matches found
USN-4898-1: curl vulnerabilities
Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2021-22876 Mingtao Yang discovered that curl incorrectly handled session tickets when using an HTTPS proxy. A...
CVE-2021-22890
A flaw was found in the way libcurl handled TLS 1.3 session tickets. A malicious HTTPS proxy could possibly use this flaw to make libcurl resume a TLS session it previously had with the proxy while intending to resume a TLS session with a target server, making it possible for the proxy to perform...
TLS 1.3 session ticket proxy host mix-up
Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes. When using an HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote serve...
CVE-2021-22890
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...
PT-2021-5820
Name of the Vulnerable Software and Affected Versions curl versions 7.63.0 through 7.75.0 Description The issue is related to the incorrect handling of TLS 1.3 session tickets, which can allow a malicious HTTPS proxy to perform a man-in-the-middle MITM attack. When using an HTTPS proxy and TLS 1....
UBUNTU-CVE-2021-21326
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 it is possible to create tickets for another user with self-service interface without delegatee systems enabled. This is...
Design/Logic Flaw
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 it is possible to create tickets for another user with self-service interface without delegatee systems enabled. This is...
CVE-2021-21435
Article Bcc fields and agent personal information are shown when customer prints the ticket PDF via external interface. This issue affects: OTRS AG OTRS 7.0.x version 7.0.23 and prior versions; 8.0.x version 8.0.10 and prior versions...
Logitech: Moderator user has access to owner's support portal and tickets
Summary: Hi there, In https://streamlabs.com, there's a function where users can share his account to other users to manage their dashboard via following link. https://streamlabs.com/dashboard/settings/shared-access. In shared-access setting, user can invite other user with two roles Moderator an...
CVE-2020-26028
An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket. permission can access Tickets...
PT-2020-16265
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.4.1 Description An issue was discovered where Admin Users without a ticket. permission can access Tickets. Recommendations For versions prior to 3.4.1, update to version 3.4.1 or later to resolve the issue...
CVE-2020-26028: Incorrect Authorization
An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket. permission can access Tickets...
Beware: not so festive social media scams
We’re now into the most crucial stage of Christmas festivities, where money and gifts are on the march…and social media is a conduit for both good and bad tidings. This is the absolute best time for social media scammers to make their move. A little confidence trick here, the promise of good chee...
AZL-36992 CVE-2020-17049 affecting package samba for versions less than 4.18.3-1
A security feature bypass vulnerability exists in the way Key Distribution Center KDC determines if a service ticket can be used for delegation via Kerberos Constrained Delegation KCD. To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service...
Mail.ru: Access User Tickets via IDOR in [widget.support.my.games]
IDOR vulnerability in widget.support.my.games allowed to disclose the user tickets...
Acronis: Ticket Trick at https://account.acronis.com
Summary Hello dear team, I found a serious issue in Acronis This vulnerability is called ticket trick vulnerability which comes under critical category. Which can allow me to login on websites like atlassian,github,clouflare,choopa,..etc on behalf of [email protected] . Steps To Reprodu...
cornellbigredtickets.universitytickets.com Open Redirect vulnerability OBB-1355740
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Cross-Site Scripting in atlasboard-atlassian-package
All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers being able t...
GHSA-25V4-MCX4-HH35 Cross-Site Scripting in atlasboard-atlassian-package
All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers being able t...
PT-2020-20949
Name of the Vulnerable Software and Affected Versions atlasboard-atlassian-package versions prior to 0.4.2 Description The issue arises from the package's failure to properly sanitize user input that is rendered as HTML, potentially allowing attackers to execute arbitrary JavaScript in a victim's...