CVE-2005-1437

Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to admin.php or 2 cat parameter to view.php...

CVE-2005-1438

PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the includedir parameter...

CVE-2005-1437

Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to admin.php or 2 cat parameter to view.php...

CVE-2005-1437

CVE-2005-1437 pertains to osTicket and is confirmed by multiple sources as a SQL injection vulnerability. The consistent detail across documents is that remote attackers could execute arbitrary SQL commands through the (1) id parameter to admin.php or (2) cat parameter to view.php, enabling unaut...

CVE-2005-1439

CVE-2005-1439 : In osTicket, a directory traversal vulnerability exists in attachments.php that allows remote attackers to read arbitrary files via .. sequences in the file parameter. Evidence from multiple sources confirms a network-wide, unauthenticated remote attack vector with a base CVSS v2 ...

CVE-2005-1439

Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter...

CVE-2005-1436

Multiple cross-site scripting XSS vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via 1 the t parameter to view.php, 2 the ostickettitle parameter to header.php, 3 the em parameter to adminlogin.php, 4 the e parameter to userlogin.php, 5 the err parameter...

CVE-2005-1438

PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the includedir parameter...

CVE-2005-1436

CVE-2005-1436 corresponds to osTicket XSS vulnerabilities across multiple input vectors. Connected sources indicate broader issues in osTicket versions <= 1.2.7 and

CVE-2005-1436

Multiple cross-site scripting XSS vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via 1 the t parameter to view.php, 2 the ostickettitle parameter to header.php, 3 the em parameter to adminlogin.php, 4 the e parameter to userlogin.php, 5 the err parameter...

CVE-2005-1439

Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter...

PT-2005-2435 · Osticket · Osticket

Name of the Vulnerable Software and Affected Versions: osTicket affected versions not specified Description: A directory traversal issue exists in the attachments.php file of osTicket, allowing remote attackers to read arbitrary files by using .. sequences in the file parameter of the...

CVE-2004-0614

osTicket trusts a hidden form field in the submit form to limit the upload size of a document, which could allow remote attackers to upload a file of any size...

CVE-2004-0613

osTicket allows remote attackers to view sensitive uploaded files and possibly execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory...

Help Center Live < 2.1.0 osTicket Multiple SQL Injection

Binary data 3521.prm...

osTicket open.php Support Address Crafted Mail Loop Remote DoS

The target is running at least one instance of osTicket 1.2.7 or earlier. Such versions are subject to a denial of service attack in open.php if osTicket is configured to receive mails using aliases. If so, a remote attacker can generate a mail loop on the target by opening a ticket with the...

osTicket Detection

osTicket was detected on the remote host. TRUSTED...

osTicket Arbitrary Attachment Disclosure

The target is running at least one instance of osTicket that enables a remote user to view attachments associated with any existing ticket. These attachments may contain sensitive information. %NASLMINLEVEL 70300 This script was written by George A. Theall, . See the Nessus Scripts License for...

osTicket Attachment Handling File Upload Arbitrary Code Execution

The target is running at least one instance of osTicket that enables a remote user to open a new ticket with an attachment containing arbitrary PHP code and then to run that code using the permissions of the web server user. %NASLMINLEVEL 70300 This script was written by George A. Theall, . See t...

osTicket Form Field Modification File Upload Size Restriction Bypass

The target is running at least one instance of osTicket that enables a remote user to a open new ticket with an attachment of unlimited size. An attacker could exploit this vulnerability and cause a denial of service by filling up the filesystem used for attachments. %NASLMINLEVEL 70300 This scri...