629 matches found
Server side request forgery (ssrf)
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...
CVE-2020-24881
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...
CVE-2020-24881
osTicket before version 1.14.3 contains CVE-2020-24881: a Server-Side Request Forgery (SSRF) flaw in the PDF/print path that lets an attacker cause the server to fetch internal resources or place malicious files on the server, enabling internal port scanning and information disclosure. The Nuclei...
osTicket Server-Side Request Forgery Vulnerability
osTicket is a widely used and trusted open source work order support ticket system. A server-side request forgery vulnerability exists in osTicket versions prior to 1.14.3. An attacker can exploit this vulnerability to add malicious files to the server or perform port scans...
osTicket < 1.14.3 Multiple Vulnerabilities
osTicket is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
osTicket cross-site scripting vulnerability (CNVD-2020-50538)
osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.14.3. The vulnerability can be exploited to conduct a cross-site scripting attack via a specially crafted filename for...
CVE-2020-24917
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...
CVE-2020-24917
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...
Cross site scripting
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...
CVE-2020-24917
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...
CVE-2020-24917
CVE-2020-24917 affects osTicket
Enhancesoft osTicket cross-site scripting vulnerability (CNVD-2020-49350)
Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A cross-site scripting vulnerability exists in versions prior to Enhancesoft osTicket 1.14.3. The vulnerability is related to the affected version failing to properly validate client data. Because of an unvalidated echo $...
CVE-2020-16193
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call...
CVE-2020-16193
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call...
Design/Logic Flaw
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call...
CVE-2020-16193
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call...
CVE-2020-16193
Summary of CVE-2020-16193 : osTicket
osTicket < 1.14.3 XSS Vulnerability
osTicket is prone to a cross-site scripting XSS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...
Enhancesoft osTicket cross-site scripting vulnerability (CNVD-2021-31228)
Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A cross-site scripting vulnerability exists in the scp/categories.php file in Enhancesoft osTicket version 1.14.2. The vulnerability stems from the lack of proper validation of client data in the WEB application, which can...