322 matches found
CVE-2022-24612
An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS...
CVE-2022-24612
EyesOfNetwork 5.3-11 is affected in its ITSM module by CVE-2022-24612: an authenticated user can upload an XML file containing JavaScript to trigger a stored cross-site scripting (XSS) vulnerability. The issue stems from processing the uploaded XML in the ITSM workflow, enabling stored XSS in aff...
CVE-2022-24612: Improper Neutralization of Input During Web Page Generation
An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS...
PT-2022-16761
Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.3.11 Description An authenticated user can upload an XML file containing an XSS via the ITSM module, resulting in a stored XSS. Recommendations For EyesOfNetwork version 5.3.11, consider disabling the XML file upload...
EyesOfNetwork 跨站脚本漏洞
EyesOfNetwork EON is an open source, free IT monitoring solution from the EyesOfNetwork community. The solution provides features such as a business process configuration tool, generating a pop-up window when an event occurs in the active queue, and more. EyesOfNetwork suffers from a cross-site...
A Dream Team-Up: Integrate InsightAppSec With ServiceNow ITSM
At Rapid7, we are constantly improving InsightAppSec and tCell with the goal of making our customers' lives easier. Over the last few months alone, we've improved the way your team structures permissions, integrated with Microsoft's .Net 6.0, and automated authentication to make scan after scan...
CVE-2013-4718
Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search...
Cross site scripting
Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search...
CVE-2013-4718
Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search...
CVE-2013-4718
CVE-2013-4718 describes a cross-site scripting (XSS) vulnerability in the Open Ticket Request System (OTRS) ITSM components. Affected are OTRS ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7. The issue allows remote authenticated users to inject arbitrary web script or HTML t...
CVE-2013-4718: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search...
Zoho ManageEngine ServiceDesk Plus MSP Information Disclosure Vulnerability
Zoho ManageEngine ServiceDesk Plus MSP is a web-based ITSM suite designed for managed service providers. An information disclosure vulnerability exists in versions prior to Zoho ManageEngine ServiceDesk Plus MSP 10522. No detailed vulnerability details are provided at this time...
Zoho ManageEngine ServiceDesk Plus MSP Improper Access Control Vulnerability
Zoho ManageEngine ServiceDesk Plus MSP is a web-based ITSM suite designed for managed service providers. An improper access control vulnerability exists in versions prior to Zoho ManageEngine ServiceDesk Plus MSP 10521. An attacker could exploit the vulnerability to access internal data...
CITSmart ITSM 9.1.2.22 LDAP Injection
Exploit Title: CITSmart ITSM 9.1.2.22 - LDAP Injection Google Dork: "citsmart.local" Date: 29/12/2020 Exploit Author: skysbsb Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html Version: = 9.1.2.23 Using this LDAP query in the usernam...
CITSmart ITSM 9.1.2.27 SQL Injection
Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection Authenticated Google Dork: "citsmart.local" Date: 11/03/2021 Exploit Author: skysbsb Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html Version: = 9.1.2.2...
CITSmart ITSM 9.1.2.22 - LDAP Injection Vulnerability
Exploit Title: CITSmart ITSM 9.1.2.22 - LDAP Injection Google Dork: "citsmart.local" Exploit Author: skysbsb Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html Version: = 9.1.2.23 Using this LDAP query in the username field of login...
CITSmart ITSM 9.1.2.27 - (query) Time-based Blind SQL Injection (Authenticated) Vulnerability
Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection Authenticated Google Dork: "citsmart.local" Exploit Author: skysbsb Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html Version: = 9.1.2.28 Vendor has...
CITSmart ITSM 9.1.2.22 - LDAP Injection
Exploit Title: CITSmart ITSM 9.1.2.22 - LDAP Injection Google Dork: "citsmart.local" Date: 29/12/2020 Exploit Author: skysbsb Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html Version: = 9.1.2.23 Using this LDAP query in the usernam...
CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)
Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection Authenticated Google Dork: "citsmart.local" Date: 11/03/2021 Exploit Author: skysbsb Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html Version: = 9.1.2.2...
CVE-2021-21437
CVE-2021-21437 affects OTRSCIsInCustomerFrontend up to version 7.0.15 and ITSMConfigurationManagement up to 7.0.24. The issue allows agents to see linked Config Items without the required permissions, as defined in General Catalog. This is a data-access problem impacting confidentiality (partial)...