816 matches found
Enhancesoft osTicket SQL注入漏洞
Enhancesoft osTicket is an open source ticketing system from Enhancesoft, USA. A security vulnerability exists in osTicket osTicket-plugins, which stems from the presence of a SQL injection vulnerability...
CVE-2022-31888
Summary: CVE-2022-31888 is a session fixation vulnerability in osTicket, affecting versions up to 1.16.2. The issue is located in the login function of class.auth.php, enabling potential session hijacking. The CVSSv3.1 vector indicates Network attack, no privileges required, user interaction requ...
CVE-2022-31890
SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...
CVE-2022-31890
SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...
CVE-2022-31888
Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2...
CVE-2022-31889: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae...
CVE-2022-31890
CVE-2022-31890 concerns a SQL injection in osTicket-plugins' audit/class.audit.php, exploitable via the order parameter to the getOrder function. The Red Hat/CNNVD/EUVD/OSV and OSV feeds corroborate the description; the core issue is lack of proper input sanitization in the getOrder path, leading...
CVE-2022-31888: Session Fixation
Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2...
PT-2023-13053 · Osticket · Osticket
Name of the Vulnerable Software and Affected Versions: osTicket versions through 1.16.2 Description: The issue is related to a Session Fixation vulnerability in the login function within class.auth.php of osTicket. This vulnerability allows an attacker to potentially hijack user sessions...
CVE-2022-31889
Cross Site Scripting XSS vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae...
PT-2023-13054 · Osticket · Osticket
Name of the Vulnerable Software and Affected Versions: osTicket osTicket-plugins versions prior to commit a7842d494889fd5533d13deb3c6a7789768795ae Description: The issue is a Cross Site Scripting XSS vulnerability in the audit/templates/auditlogs.tmpl.php file. This vulnerability can be exploited...
Improper Restriction of Rendered UI Layers or Frames
Description The osTicket uses an incorrect method to validate the src attribute of the iframe tag. Although it appears that osTicket restricts domains through a whitelist, attackers can easily bypass this restriction. Proof of Concept This iframe is going to render www.youtube.com.attacker's serv...
osTicket < 1.16.6, 1.17.x < 1.17.3 Multiple XSS Vulnerabilities
osTicket is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
CVE-2023-1319
Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-1316
Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-1317
Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-1318
Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-1315
Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prior to v1.16.6...
