369 matches found
CVE-2003-1476
Cerberus FTP Server 2.1 stores usernames and passwords in plaintext, which could allow local users to gain access...
CVE-2003-1476
CVE-2003-1476 affects Cerberus FTP Server 2.1. The provided documents describe a plaintext storage of usernames and passwords, which could allow local users to gain access. This disclosure aligns with a local-privilege concern but the connected sources do not provide explicit exploit vectors, imp...
CVE-2006-6366
Cross-site scripting XSS vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details ar...
CVE-2006-6366
Cerberus Helpdesk is affected by a Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php. The js parameter can be exploited to inject arbitrary script/HTML in versions 0.97.3, 2.0–2.7, 3.2.1, and 3.3. This is a remote issue described in the CVE entry; exploitation ...
CVE-2006-6366
Cross-site scripting XSS vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details ar...
Cerberus Helpdesk 2.x - Spellwin.php Cross-Site Scripting
Cerberus Helpdesk 2.x - Spellwin.php Cross-Site Scripting source: https://www.securityfocus.com/bid/21423/info Cerberus Helpdesk is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have...
Cerberus Helpdesk 2.x - 'Spellwin.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/21423/info Cerberus Helpdesk is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecti...
Cerberus Helpdesk rpc.php Information Disclosure
Binary data 3797.prm...
CVE-2006-5428
rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a displaygetrequesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information ticket data via a direct request...
CVE-2006-5428
rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a displaygetrequesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information ticket data via a direct request...
CVE-2006-5428
CVE-2006-5428 : Cerberus Helpdesk 3.2.1 contains an information-disclosure flaw in rpc.php where it does not verify a client’s privileges for display_get_requesters. This allows an unauthenticated or improperly authenticated user to bypass the GUI login and directly retrieve sensitive ticket data...
Cerberus Helpdesk 3.2.1 - 'Rpc.php' Unauthorized Access
source: https://www.securityfocus.com/bid/20598/info Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to authenticate users properly, resulting in an improper-access validation. A workaround is available. An attacker can exploit this vulnerability t...
Cerberus Helpdesk rpc.php Arbitrary Ticket Information Disclosure
The remote host is running Cerberus Helpdesk, a web-based helpdesk suite written in PHP. The installed version of Cerberus Helpdesk on the remote host allows an unauthenticated attacker to retrieve information about ticket requesters through the 'rpc.php' script. %NASLMINLEVEL 70300 C Tenable...
Cerberus Helpdesk 3.2.1 - Rpc.php Unauthorized Access
Cerberus Helpdesk 3.2.1 - Rpc.php Unauthorized Access source: https://www.securityfocus.com/bid/20598/info Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to authenticate users properly, resulting in an improper-access validation. A workaround is...
CVE-2006-4539
1 includes/widgets/modulecompanytickets.php and 2 includes/widgets/moduletracktickets.php Client Support Center in Cerberus Helpdesk 3.2 Build 317, and possibly earlier, allows remote attackers to bypass security restrictions and obtain sensitive information via the ticket parameter. NOTE: the...
CVE-2006-4539
1 includes/widgets/modulecompanytickets.php and 2 includes/widgets/moduletracktickets.php Client Support Center in Cerberus Helpdesk 3.2 Build 317, and possibly earlier, allows remote attackers to bypass security restrictions and obtain sensitive information via the ticket parameter. NOTE: the...
CVE-2006-4539
Cerberus Helpdesk 3.2 Build 317 (and possibly earlier) is affected by CVE-2006-4539. The vulnerability arises from two widgets (module_company_tickets.php and module_track_tickets.php) that allow remote attackers to bypass security restrictions and obtain sensitive information via the ticket para...
[SA21706] Cerberus Helpdesk "ticket" Parameter Arbitrary Ticket Access
TITLE: Cerberus Helpdesk "ticket" Parameter Arbitrary Ticket Access SECUNIA ADVISORY ID: SA21706 VERIFY ADVISORY: http://secunia.com/advisories/21706/ CRITICAL: Moderately critical IMPACT: Security Bypass, Exposure of sensitive information WHERE: From remote SOFTWARE: Cerberus Helpdesk 2.x...
cerberusXSS.txt
Inputs in the Cerberus Helpdesk is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. You can add XSS that will hit every user of the system, and even simple scripting tags like alertf is allowed PoC:...
CVE-2006-0509
Multiple cross-site scripting XSS vulnerabilities in clients.php in Cerberus Helpdesk, possibly 2.7, allow remote attackers to inject arbitrary web script or HTML via 1 the contactsearch parameter and 2 unspecified url fields...