UBUNTU-CVE-2021-21443

Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG OTRS Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27...

CVE-2021-21443

Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG OTRS Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27...

CVE-2021-21443

Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG OTRS Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27...

CVE-2021-21443 Unautorized listing of the customer user emails

Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG OTRS Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27...

PT-2021-6460 · Otrs Ag +1 · Otrs +2

Name of the Vulnerable Software and Affected Versions: OTRS AG OTRS Community Edition versions 6.0.1 and later OTRS AG OTRS versions prior to 7.0.27 Description: The issue is related to errors in permission handling in the OTRS ticket system, allowing an attacker to remotely access confidential...

OTRS 信息泄露漏洞

OTRS is an application from the German company OTRS. A service management software. An information disclosure vulnerability exists in OTRS AG OTRS Community Edition, which stems from an agent being able to list customer user emails in a bulk action screen without requiring privileges...

CVE-2021-21443: Exposure of Sensitive Information to an Unauthorized Actor

Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG OTRS Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27...

CVE-2021-37459

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the customer name field stored...

CVE-2021-37468

NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files...

CVE-2021-37459

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the customer name field stored...

Cross site scripting

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the customer name field stored...

NCH Axon PBX 跨站脚本漏洞

NCH Axon PBX is a set of virtual telephone switch software used in a business environment. A cross-site scripting vulnerability exists in NCH Axon PBX, which stems from the fact that the product's customer name does not properly filter special characters in the input data and can be exploited to...

CVE-2021-37459: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the customer name field stored...

Security Bulletin: IBM i2 Analyst's Notebook Premium has an information disclosure vulnerability (CVE-2021-29784)

Summary More information than is necessary is sometimes displayed in i2 Analyst's Notebook Premium error dialogs. Vulnerability Details CVEID: CVE-2021-29784 DESCRIPTION: IBM i2 Analyze could allow a remote attacker to obtain sensitive information when a detailed technical error message is return...

Security Bulletin: IBM Analyst's Notebook Premium uses a component with known vulnerabilities (CVE-2020-16013, CVE-2020-16009, CVE-2020-15999)

Summary IBM i2 Analyst's Notebook Premium uses a browser component version with known vulnerabilities. Vulnerability Details CVEID: CVE-2020-16013 DESCRIPTION: Google Chrome could allow a remote attacker to bypass security restrictions, caused by inappropriate implementation in V8. By persuading ...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to perform a cross-site scripting XSS attack against a user. This vulnerability is due to insufficient input validation of a parameter that is used by the...

CVE-2021-1599 Cisco Unified Customer Voice Portal Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to perform a cross-site scripting XSS attack against a user. This vulnerability is due to insufficient input validation of a parameter that is used by the...

CVE-2021-1599 Cisco Unified Customer Voice Portal Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to perform a cross-site scripting XSS attack against a user. This vulnerability is due to insufficient input validation of a parameter that is used by the...

CVE-2021-1599

Cisco CVP's web-based management interface is affected by CVE-2021-1599 via insufficient input validation of a parameter, enabling an authenticated remote attacker to perform cross-site scripting. Exploitation could lead to arbitrary code execution in the interface, access to browser-based data, ...

HackerOne: Internal Gitlab Ticket Disclosure via External Slack Channels

@noneoftheabove was able to enumerate GitLab ticket titles and descriptions by posting links in a shared Slack channel. As part of HackerOne's investigation, it was determined that the misconfiguration could also be used to obtain the contents of exceptions from HackerOne's production environment...