PT-2026-95247

Name of the Vulnerable Software and Affected Versions Easy Appointments versions prior to 4.0.2.2 Description The plugin fails to use an unguessable token to authorize appointment cancellation and confirmation actions via mail-links. The token is derived from a hardcoded source-embedded salt and...

CVE-2018-17883

An issue was discovered in Open Ticket Request System OTRS 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS...

Protect your site with URL rewriting

Over at Microsoft’s MSDN magazine, there’s a really interesting article by Bryan Sullivan suggesting a defense-in-depth strategy to protect Web sites and applications from cross-site scripting XSS and cross-site request forgery XSRF attacks. Here’s the gist of Sullivan’s recommendation: Attacks...