CVE-2023-52268

FreeScout End-User Portal 認証バイパスエクスプロイト CVE-2023-52268 概要 このエクスプロイトは、FreeScout End-User Portal モジュール （バージョン 1.0.65...

PT-2025-112: Stored XSS in FreeScout

The vulnerability was identified in FreeScout, version 1.8.182. The discovered vulnerability allows an attacker to inject arbitrary HTML tags and JavaScript into web pages, resulting in execution of malicious code in the victim’s browser. Vulnerability status: Confirmed by vendor Date of...

CVE-2023-52268

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub...

CVE-2023-52268

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub...

CVE-2023-52268: Session Fixation

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub...

CVE-2023-52268

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub...

CVE-2023-52268

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub...

CVE-2023-52268

The FreeScout End-User Portal module (versions before 1.0.65 ) contains a vulnerability where improper session token management in the magic link authentication mechanism allows an attacker to authenticate as an arbitrary user . By sending a session token to the /auth endpoint, an attacker can im...

Exploit for CVE-2023-52268

FreeScout End-User Portal Authentication Bypass Exploit CVE-2...

PT-2024-14501 · Unknown · Freescout End-User Portal

Name of the Vulnerable Software and Affected Versions: FreeScout End-User Portal module versions prior to 1.0.65 Description: The issue allows an attacker to authenticate as an arbitrary user because a session token can be sent to the "/auth" endpoint. Recommendations: For versions prior to 1.0.6...

CVE-2022-22798

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp...

PT-2022-15687 · Sysaid · Sysaid

Name of the Vulnerable Software and Affected Versions: Sysaid – Pro Plus Edition versions v20.4.74 b10 through v22.1.30 b49 Description: The issue allows an attacker to bypass access controls by logging in as a guest and manipulating the URL path to access the system dashboard. The attacker can...

CVE-2018-0238

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

CVE-2018-0238

CVE-2018-0238 affects Cisco UCS Director; an attacker can log in with a modified username and valid password to gain visibility into and perform actions on any VM in the end-user portal. Root cause: improper user authentication checks in role-based resource checking; impact includes information d...

CVE-2018-0238: Improper Authentication

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

Cisco UCS Director Virtual Machine Information Disclosure Vulnerability for End User Portal

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

CVE-2017-17947

A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure PCS before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure PPS before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL...