Enhancesoft osTicket cross-site scripting vulnerability (CNVD-2020-31757)

Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A cross-site scripting vulnerability exists in the include/class.sla.php file in Enhancesoft osTicket versions prior to 1.14.2. The vulnerability stems from a lack of proper validation of client data in the WEB application...

CVE-2020-12629

include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name...

CVE-2020-12629: Improper Neutralization of Input During Web Page Generation

include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name...

PT-2020-13174

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.14.2 Description The issue allows for XSS via the SLA Name in the include/class.sla.php file. Recommendations For versions prior to 1.14.2, update to version 1.14.2 or later to resolve the issue...

CVE-2020-12479

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...

CVE-2020-12479

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...

Directory traversal

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...

CVE-2020-12479

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...

CVE-2020-12479

VULNERABILITY SUMMARY: TeamPass 2.1.27.36 is affected by a PHP file include (directory traversal) vulnerability triggered through crafted HTTP requests to sources/users.queries.php with the newValue parameter. The issue allows any authenticated TeamPass user to cause inclusion of arbitrary files,...

PT-2020-13138

Name of the Vulnerable Software and Affected Versions TeamPass version 2.1.27.36 Description The issue allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php using newValue directory traversal. Recommendations F...

CVE-2020-12479: Improper Limitation of a Pathname to a Restricted Directory

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...

gyges.org Open Redirect vulnerability

Open Bug Bounty ID: OBB-1145820 Security Researcher myNickName Helped patch 200 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting gyges.org website and its users. Following coordinat...

ALPINE-CVE-2019-12521

An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elemen...

holz-becker.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1142773 Security Researcher Hchabik Helped patch 2358 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting holz-becker.com website and...

Privilege Escalation

The Apache HTTP Server is vulnerable to Privilege Escalation. A flaw was found in the handling of the "Options" and "AllowOverride" directives. In configurations using the "AllowOverride" directive with certain "Options=" arguments, local users were not restricted from executing commands from a...

tweaksguide.com Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8505 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting tweaksguide.com website and its users. Following coordinat...

PT-2020-5391

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.6.5 Description A signal access-control issue was discovered in the Linux kernel. The issue is caused by an integer overflow in the exec id variable in include/linux/sched.h, which can interfere with a protecti...

ColdFusion PHP Function Execution

The vulnerability of the ColdFusion software platform relates to the names of PHP functions include or require. Exploiting this vulnerability allows a malicious actor to execute arbitrary PHP code on the target system by sending a specially crafted HTTP request...

FIBARO System Home Center 5.021 - Remote File Include

FIBARO System Home Center 5.021 - Remote File Include Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Date: 2020-03-22 Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3,...

FIBARO System Home Center 5.021 - Remote File Include Vulnerability

Exploit for multiple platform in category web applications Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3, Home Center...