Cross site scripting

Cross-site scripting XSS vulnerability in the rich-text-editor component in Open Ticket Request System OTRS before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface...

CVE-2010-4762

Cross-site scripting XSS vulnerability in the rich-text-editor component in Open Ticket Request System OTRS before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface...

CVE-2009-5055

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

Open redirect

Open Ticket Request System OTRS before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions...

CVE-2010-4761

The customer-interface ticket-print dialog in Open Ticket Request System OTRS before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the 1 responsible, 2 owner, 3 accounted time, 4 pending until...

CVE-2010-4761

The CVE-2010-4761 entry describes an information-disclosure flaw in Open Ticket Request System (OTRS) prior to version 3.0.0-beta3. The vulnerability arises in the customer-interface ticket-print dialog, which does not properly restrict customer-visible data, enabling remote authenticated users t...

CVE-2010-4762

Cross-site scripting XSS vulnerability in the rich-text-editor component in Open Ticket Request System OTRS before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface...

CVE-2010-4763

The ACL-customer-status Ticket Type setting in Open Ticket Request System OTRS before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the 1 Status, 2 Service, and 3 Queue via selections...

CVE-2010-4763

Removed by vendor...

CVE-2010-4762

Removed by vendor...

CVE-2008-7283

Removed by vendor...

CVE-2008-7283

Open Ticket Request System OTRS before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions...

CVE-2010-4761

Removed by vendor...

CVE-2011-0745

SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover 1 the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or 2 t...

CVE-2011-0745

SugarCRM prior to 6.1.3 is affected by CVE-2011-0745. The issue arises when reloading or directly requesting a warning page produced by a duplicate-check, allowing remote authenticated users to see names they normally should not access: (1) customer names via ShowDuplicates in the Accounts module...

Important: Red Hat Security Advisory: JBoss Enterprise SOA Platform 4.3.CP04 and 5.0.2 security update

Updated jbossweb-2.0.0.jar and jbossweb-2.1.10.jar files for JBoss Enterprise SOA Platform 4.3.CP04 and 5.0.2 that fix one security issue are now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common...

Database of banking recruitment website Efinancialcareers-gulf.com hacked !

The database of global banking recruitment website efinancialcareers-gulf.com has been hacked, according to the former CEO of Credit Suisse Private Bank Australia, Nick Kalikajaros. The British company that has Australian operations believed its registered users' names, email addresses, registere...

Indian Hacker shared his video of hacking Microsoft Kinect Xbox to control Tata Sky !

The desire of remote free experience urged Harishankar Narayan a mechanical Engineer to hack into the Microsoft Kinect Xbox and control Tata Sky through Kinetic Movements. In a You Tube video which he has uploaded the man is seen controlling the Tata Sky with the movements of his hands. The...

Lush takes down two regional sites following another hack !

Last month's compromise of the UK website of the natural ingredients cosmetic firm Lush and the theft of its customers' credit card details must have hurt the company but unfortunately, its troubles are not over yet. "We are sorry to have to announce that the Lush Australian and New Zealand...

Lush Cosmetics Australian website hacked !

The Australian and New Zealand shopping site of cosmetics retailer Lush has been hacked just weeks after a similar breach occurred on the UK site. Credit card details and other intimate information of shoppers have been exposed. If you visit the Lush Cosmetics Australian website you will find a...