707 matches found
The vulnerability of the osTicket customer support system, related to the lack of mechanisms to neutralize elements in the CSV file, allows a violator to execute arbitrary code.
The vulnerability of the osTicket customer support system lies in the lack of a mechanism to eliminate certain elements in the CSV file specifically, the fields “Name” and “Internal Notes” in the “Users” tab. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
osTicket cross-site scripting vulnerability (CNVD-2021-48883)
osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/ajax.search.php...
CVE-2020-22609
Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...
CVE-2020-22609
Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...
CVE-2020-22608
Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...
CVE-2020-22608
Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...
Cross site scripting
Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...
Cross site scripting
Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...
CVE-2020-22609
Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...
CVE-2020-22609
CVE-2020-22609 is an XSS vulnerability in osTicket prior to v1.12.6. Affected component: include/class.queue.php; attacker can inject scripts via the queue-name parameter. Root cause: improper input handling leads to reflected/stored XSS (per the sources confirming the queue-name vector). Impact ...
CVE-2020-22608
Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...
CVE-2020-22608
CVE-2020-22608 affects osTicket (Enhancesoft) prior to v1.12.6. A cross-site scripting vulnerability exists via the queue-name parameter in include/ajax.search.php. Impact is consistent with XSS as described in multiple sources; CVSS v3.1 base score 6.1 (NETWORK, LOW ATTACK COMPLEXITY, USER INTER...
Enhancesoft osTicket 跨站脚本漏洞
osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/ajax.search.php...
Enhancesoft osTicket 跨站脚本漏洞
osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/class.queue.php...
osTicket 1.14.2 Server-Side Request Forgery
Exploit Title: osTicket 1.14.2 - SSRF Date: 18-01-2021 Exploit Author: Talat Mehmood Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Version: 4. After submitting this comment, print this ticket. 5. You'll receive a hit on your malicious website from the intern...
osTicket 1.14.2 - SSRF
Exploit Title: osTicket 1.14.2 - SSRF Date: 18-01-2021 Exploit Author: Talat Mehmood Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Version: 4. After submitting this comment, print this ticket. 5. You'll receive a hit on your malicious website from the intern...
CVE-2020-24881
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...
CVE-2020-24881
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...