DEBIAN-CVE-2010-4763

The ACL-customer-status Ticket Type setting in Open Ticket Request System OTRS before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the 1 Status, 2 Service, and 3 Queue via selections...

CVE-2009-5056

Open Ticket Request System OTRS before 2.4.0-beta2 does not properly enforce the moveinto permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-ticket...

CVE-2009-5055

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

Open redirect

Open Ticket Request System OTRS before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to cause a denial of service daemon hang via a fulltext search...

CVE-2009-5057

The S/MIME feature in Open Ticket Request System OTRS before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations,...

CVE-2010-4768

Open Ticket Request System OTRS before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remov...

CVE-2008-7283

CVE-2008-7283 concerns the Open Ticket Request System (OTRS) prior to version 2.2.6. The Red Hat, NVD, Ubuntu, Debian, OSV, and CVE listings consistently describe that when customer group support is enabled, remote authenticated users can bypass intended access restrictions and perform web-interf...

Seccubus 2.0.alpha1 released, Download Now !

So what is the difference between Seccubus V2 and Seccubus V2 ? Before you try something new you want to know if it is going to be worth it. This article should give you an idea of why we spend quite a lot of time and energy in rebuilding Seccubus V2 from scratch. I clearly recall the conversatio...

DEBIAN-CVE-2010-0438

Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System OTRS 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in admin.php in MRCGIGUY The Ticket System 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewticket action...

CVE-2009-2639

SQL injection vulnerability in admin.php in MRCGIGUY The Ticket System 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewticket action...

CVE-2009-2639

SQL injection vulnerability in admin.php in MRCGIGUY The Ticket System 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewticket action...

CVE-2009-2639

CVE-2009-2639 affects MRCGIGUY The Ticket System 2.0 (admin.php) where the viewticket action vulnerable to SQL injection via the id parameter. Root cause is unsafely concatenated SQL in the vulnerable endpoint, enabling remote arbitrary SQL execution. Consequences described are arbitrary SQL comm...

osTicket 1.6 RC4 Admin Login Blind SQL Injection Vulnerability

No description provided by source. nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2009-007 osTicket Admin Login Blind SQL Injection Application: osTicket v1.6 RC4 Vendor: osTicket Vendor website: http://www.osticket.com Author: Adam Baldwin [email protected] I...

CVE-2009-2080

admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to 1 obtain sensitive configuration information via the editconfig action or 2 change the administrator's password via the id parameter in an editop action...

CVE-2009-2080

CVE-2009-2080 concerns admin.php in MRCGIGUY The Ticket System 2.0. The vulnerability is a failure to properly restrict access, enabling remote attackers to (1) obtain sensitive configuration information via the editconfig action and (2) change the administrator’s password via the id parameter in...

MRCGIGUY The Ticket System 2.0 PHP Multiple Remote Vulnerabilities

No description provided by source. MRCGIGUY The Ticket System 2.0 PHPid Multiple Remote Vulnerabilities Founder: ThE g0bL!N ------ Home: http:/www.4ckx.com/dz/ ---- Vendor:http://www.mrcgiguy.com Special Thx: All Muslims All Members Of Team Algerien Of FootBall Note: Algerie 3-1 Egypt Exploit:...

MRCGIGUY The Ticket System 2.0 SQL Injection

MRCGIGUY The Ticket System 2.0 PHPid Multiple Remote Vulnerabilities Founder: ThE g0bL!N ------ Home: http:/www.4ckx.com/dz/ ---- Vendor:http://www.mrcgiguy.com Special Thx: All Muslims All Members Of Team Algerien Of FootBall Note: Algerie 3-1 Egypt Exploit: ------ SQL INJECTION: -------------...

mrcgiguy the ticket system 2.0 PHP - Multiple Vulnerabilities

MRCGIGUY The Ticket System 2.0 PHPid Multiple Remote Vulnerabilities Founder: ThE g0bL!N ------ Home: http:/www.4ckx.com/dz/ ---- Vendor:http://www.mrcgiguy.com Special Thx: All Muslims All Members Of Team Algerien Of FootBall Note: Algerie 3-1 Egypt Exploit: ------ SQL INJECTION: -------------...

MRCGIGUY The Ticket System 2.0 PHP Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ================================================================== MRCGIGUY The Ticket System 2.0 PHP Multiple Remote Vulnerabilities ================================================================== MRCGIGUY The Ticket System 2.0 PHPid...