PT-2022-7432 · Phpcas +4 · Phpcas +4

Name of the Vulnerable Software and Affected Versions: phpCAS versions prior to 1.6.0 Description: The phpCAS library uses HTTP headers to determine the service URL used to validate tickets, allowing an attacker to control the host header and use a valid ticket granted for any authorized service ...

Exception logging in Sharepoint app reveals clear-text connection details

None...

Profile of disabled user stays accessible

None...

Stored XSS - Entity name not sanitize in Ticket creation page

Description An Administrator can set a Cross-Site Scripting XSS payload inside an entity name. This XSS will be executed on the Ticket Creation page Menu - Assistance - Create Ticket. Proof of Concept 1. Set an XSS in Entity name 2. Go to the "Create Ticket" page 3. XSS is excuted...

October 25, 2022—KB5018485 (OS Build 20348.1194) Preview

None None...

OTRS 安全漏洞

OTRS is an application from OTRS Germany. A service management software. A security vulnerability exists in OTRS version 8.0.x, version 7.0.x. An attacker exploits the vulnerability to send specially crafted emails with numerous recipients and trigger a denial of service attack...

Man In The Middle (MitM)

samba:xenial is vulnerable to man-in-the-middle. A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name principal in the request with any...

CVE-2022-1719

Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page...

WordPress YDS Support Ticket System Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Trudesk 跨站脚本漏洞

Chris Brame Trudesk is an open source helpdesk/ticketing solution from Chris Brame USA. A cross-site scripting vulnerability exists in Trudesk versions prior to 1.2.2, which stems from reflected XSS on the ticket filtering functionality, which is capable of executing malicious javascript code in ...

CVE-2022-40817

Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2...

CVE-2022-40817

CVE-2022-40817 affects Zammad 5.2.1 where a fine-grained permission model intended for read-only tickets still allowed certain operations (adding/removing links, tags, related answers). Root cause: permissions logic did not enforce read-only restrictions for these actions. Impact: unauthorized-li...

PT-2022-25554 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions 5.2.1 Description: The issue concerns a fine-grained permission model in Zammad that allows configuration of read-only access to tickets. However, agents were still able to perform certain operations on these tickets, such as...

CVE-2022-36388

Cross-Site Request Forgery CSRF vulnerability in YDS Support Ticket System plugin = 1.0 at WordPress...

CVE-2022-36388

Cross-Site Request Forgery CSRF vulnerability in YDS Support Ticket System plugin = 1.0 at WordPress...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in YDS Support Ticket System plugin = 1.0 at WordPress...

CVE-2022-36388 WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in YDS Support Ticket System plugin = 1.0 at WordPress...

CVE-2022-36388 WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in YDS Support Ticket System plugin = 1.0 at WordPress...

CVE-2022-36388

CVE-2022-36388 : A CSRF vulnerability exists in the WordPress plugin “YDS Support Ticket System” up to version 1.0. The root cause is insufficient CSRF validation in the plugin, allowing an attacker to trick an authenticated user into performing unwanted actions. Reported CVSS v3.1 base metrics i...

WordPress plugin YDS Support Ticket System 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...