Enhancesoft osTicket SQL注入漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, USA. A security vulnerability exists in osTicket osTicket-plugins, which stems from the presence of a SQL injection vulnerability...

Enhancesoft osTicket 跨站脚本漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, USA. A security vulnerability exists in osTicket osTicket-plugins, which stems from the discovery of a cross-site scripting XSS vulnerability contained in audit/templates/auditlogs.tmpl.php...

CVE-2022-31888

Summary: CVE-2022-31888 is a session fixation vulnerability in osTicket, affecting versions up to 1.16.2. The issue is located in the login function of class.auth.php, enabling potential session hijacking. The CVSSv3.1 vector indicates Network attack, no privileges required, user interaction requ...

CVE-2022-31889

The CVE-2022-31889 entry concerns a Cross Site Scripting (XSS) vulnerability in the file audit/templates/auditlogs.tmpl.php within osTicket-plugins, affected prior to the commit a7842d494889fd5533d13deb3c6a7789768795ae. Public references describe the vulnerability location as audit/templates/audi...

CVE-2022-31890

CVE-2022-31890 concerns a SQL injection in osTicket-plugins' audit/class.audit.php, exploitable via the order parameter to the getOrder function. The Red Hat/CNNVD/EUVD/OSV and OSV feeds corroborate the description; the core issue is lack of proper input sanitization in the getOrder path, leading...

CVE-2022-31890

SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...

CVE-2022-31888

Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2...

CVE-2022-31890

SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...

CVE-2022-31889

Cross Site Scripting XSS vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae...

Improper Restriction of Rendered UI Layers or Frames

Description The osTicket uses an incorrect method to validate the src attribute of the iframe tag. Although it appears that osTicket restricts domains through a whitelist, attackers can easily bypass this restriction. Proof of Concept This iframe is going to render www.youtube.com.attacker's serv...

osTicket < 1.16.6, 1.17.x < 1.17.3 Multiple XSS Vulnerabilities

osTicket is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2023-1317

Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prior to v1.16.6...

CVE-2023-1319

Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...

CVE-2023-1318

Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to v1.16.6...

CVE-2023-1316

Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...

CVE-2023-1315

Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prior to v1.16.6...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...

Cross site scripting

Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to v1.16.6...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...