Cross site scripting

An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid, formName, FrameId, or MODE parameter...

PT-2019-9068

Name of the Vulnerable Software and Affected Versions Polaris FT Intellect Core Banking version 9.7.1 Description A reflected XSS issue exists in the Core and Portal modules, which can be exploited with an authenticated session. The issue is related to the Customerid, formName, FrameId, or MODE...

CVE-2018-14875: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid, formName, FrameId, or MODE parameter...

Design/Logic Flaw

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...

PT-2013-5950

Name of the Vulnerable Software and Affected Versions vBulletin versions 4.1 and 5 Description The issue allows remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters. This has been exploited in the wild...

OTRS < 2.4.4 Ticket CustomerID Value Restriction Bypass Vulnerability

Open Ticket Request System OTRS is prone to a restriction bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2013-3584

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

Cross site scripting

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

CVE-2013-3584

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

CVE-2013-3584

The CVE-2013-3584 entry refers to a reflected Cross‑Site Scripting vulnerability in Corporater EPM Suite, exploitable via the vulnerable query string parameter customerId in an unspecified component. The CERT doc confirms this as part of CVE-2013-3584 and notes that injected HTML/script could be ...

PT-2013-4496

Name of the Vulnerable Software and Affected Versions Corporater EPM Suite affected versions not specified Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the...

CVE-2013-3584: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

CVE-2009-5055

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

CVE-2009-5055

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

Design/Logic Flaw

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

CVE-2009-5055

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

CVE-2009-5055

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

PT-2011-1316

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.4.4 Description The issue allows remote authenticated users to bypass intended access restrictions by visiting a ticket, leveraging single-digit substrings of the CustomerID value. This can b...

CVE-2009-5055: Undefined Security Weakness

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

CVE-2006-5184

SQL injection vulnerability in PKR Internet Taskjitsu before 2.0.6 allows remote attackers to execute arbitrary SQL commands via the key parameter, when the limit query parameter is set to customerid...