PHP Helpdesk 0.6.16 - index.php Local File Inclusion

PHP Helpdesk 0.6.16 - index.php Local File Inclusion source: www.securityfocus.com/bid/26318/info PHP Helpdesk is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view files and execute...

PHP Helpdesk 0.6.16 - 'index.php' Local File Inclusion

source: www.securityfocus.com/bid/26318/info PHP Helpdesk is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view files and execute local scripts. PHP Helpdesk 0.6.16 is vulnerable to th...

Cross site scripting

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in t...

CVE-2007-5727

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in t...

CVE-2007-5727

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in t...

CVE-2007-5727

CVE-2007-5727 describes an incomplete blacklist vulnerability in OneOrZero Helpdesk (common.php, stripScripts) that allows remote XSS via the description parameter to tcreate.php or tupdate.php (e.g., using an onmouseover event in a tag). Affected versions include 1.6.5.4 and 1.6.4.2, with poten...

usd250 helpdesk XSS vulnerabily.

http://www.oneorzero.com/ Within the helpdesk utility usd250, an XSS in the comments field is possible. The comments strip script tags and replace them with not allowed, but script tags dont need to be in place for XSS. Something along the lines of... b onmouseover="window.alert'omghax'"some text...

CVE-2004-2736

Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie...

CVE-2004-2737

Affected software: NetSupport DNA HelpDesk 1.01. ** vulnerability:** SQL injection in problist.asp via the where parameter. Impact as described: remote attackers can execute arbitrary SQL commands through the vulnerable parameter. The available documents do not detail exploitation vectors beyond ...

CVE-2004-2736

Polar HelpDesk 3.0 is affected by an authentication bypass vulnerability where an attacker can bypass login by manipulating the UserId and UserType cookie. The issue allows remote access without valid credentials and, per the Nessus entry, may enable administrative rights on the remote system. Th...

CVE-2007-5176

Multiple cross-site scripting XSS vulnerabilities in GroupLink eHelpDesk 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 NADISPLAYNAME parameter in helpdesk/user/rfcreate.jsp and the 2 username and 3 LDAPError parameters in index2.jsp. NOTE: the provenance of this...

CVE-2007-1638

Multiple cross-site request forgery CSRF vulnerabilities in the checkcsrftoken function in lib/lib.inc.php in PHProjekt 5.2.0, when magicquotesgpc is disabled, allow remote attackers to perform unauthorized actions as an arbitrary user via the 1 Projects, 2 Contacts, 3 Helpdesk, 4 Notes, 5 Search...

LeighBusinessEnterprisesWebHelpDeskSQL注入漏洞

LBE Web Helpdesk是一款可通过WEB浏览器进行操作的Helpdesk系统。LBE Web Helpdesk不正确过滤用户提交的数据，远程攻击者可以利用这个漏洞进行SQL注入攻击，可能获得敏感数据或修改数据库。问题存在于jobedit.asp脚本对用户提交给'id'参数缺少过滤，提交包含恶意SQL命令的数据作为'id'参数，可修改'users'表，增加操作员相等权限的新用户。 Leigh Business Enterprises Web HelpDesk 4.0.0.80 临时解决方法：如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 在$nick...

CVE-2006-6380

Cross-site scripting XSS vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter...

CVE-2006-6381

Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2006-6381

The CVE-2006-6381 entry describes a directory traversal vulnerability in Ultimate HelpDesk, specifically in getfile.asp, where remote attackers can read arbitrary files by supplying a .. (dot dot) in the filename parameter. The affected software/component is Ultimate HelpDesk (getfile.asp). Root ...

CVE-2006-6381

Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2006-6380

Cross-site scripting XSS vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter...

CVE-2006-6380

CVE-2006-6380 concerns a Cross-site Scripting (XSS) vulnerability in Ultimate HelpDesk’s index.asp, exploitable via the keyword parameter. The issue allows remote attackers to inject arbitrary web script or HTML into the page, with the potential to affect users’ sessions and data depending on the...

CVE-2006-6366

Cross-site scripting XSS vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details ar...