Session fixation

Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2...

CVE-2022-31888

Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2...

CVE-2022-31890

SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...

Enhancesoft osTicket SQL注入漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, USA. A security vulnerability exists in osTicket osTicket-plugins, which stems from the presence of a SQL injection vulnerability...

CVE-2022-31889

Cross Site Scripting XSS vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae...

Enhancesoft osTicket 跨站脚本漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, USA. A security vulnerability exists in osTicket osTicket-plugins, which stems from the discovery of a cross-site scripting XSS vulnerability contained in audit/templates/auditlogs.tmpl.php...

CVE-2022-31888

Summary: CVE-2022-31888 is a session fixation vulnerability in osTicket, affecting versions up to 1.16.2. The issue is located in the login function of class.auth.php, enabling potential session hijacking. The CVSSv3.1 vector indicates Network attack, no privileges required, user interaction requ...

CVE-2022-31889

The CVE-2022-31889 entry concerns a Cross Site Scripting (XSS) vulnerability in the file audit/templates/auditlogs.tmpl.php within osTicket-plugins, affected prior to the commit a7842d494889fd5533d13deb3c6a7789768795ae. Public references describe the vulnerability location as audit/templates/audi...

CVE-2022-31890

CVE-2022-31890 concerns a SQL injection in osTicket-plugins' audit/class.audit.php, exploitable via the order parameter to the getOrder function. The Red Hat/CNNVD/EUVD/OSV and OSV feeds corroborate the description; the core issue is lack of proper input sanitization in the getOrder path, leading...

Enhancesoft osTicket和Session 授权问题漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, Inc. in the U.S. Session is a new type of encrypted private messenger open-sourced by Oxen. A security vulnerability exists in osTicke 1.16.2 and earlier versions, which stems from a session fixation vulnerability in a...

PT-2023-13053 · Osticket · Osticket

Name of the Vulnerable Software and Affected Versions: osTicket versions through 1.16.2 Description: The issue is related to a Session Fixation vulnerability in the login function within class.auth.php of osTicket. This vulnerability allows an attacker to potentially hijack user sessions...

PT-2023-13054 · Osticket · Osticket

Name of the Vulnerable Software and Affected Versions: osTicket osTicket-plugins versions prior to commit a7842d494889fd5533d13deb3c6a7789768795ae Description: The issue is a Cross Site Scripting XSS vulnerability in the audit/templates/auditlogs.tmpl.php file. This vulnerability can be exploited...

CVE-2022-31889

Cross Site Scripting XSS vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae...

CVE-2022-31888

Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2...

CVE-2022-31890

SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...

CVE-2022-31889

Cross Site Scripting XSS vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae...

CVE-2022-31888

Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2...

CVE-2022-31890

SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...

Improper Restriction of Rendered UI Layers or Frames

Description The osTicket uses an incorrect method to validate the src attribute of the iframe tag. Although it appears that osTicket restricts domains through a whitelist, attackers can easily bypass this restriction. Proof of Concept This iframe is going to render www.youtube.com.attacker's serv...

osTicket < 1.16.6, 1.17.x < 1.17.3 Multiple XSS Vulnerabilities

osTicket is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...