[SECURITY] [DSA 4697-1] gnutls28 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4697-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 06, 2020 https://www.debian.org/security/faq -...

Ubuntu: Security Advisory (USN-4384-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4384-1 gnutls28 vulnerability

It was discovered that GnuTLS incorrectly handled session ticket encryption keys. A remote attacker could possibly use this issue to bypass authentication or recover sensitive information...

ALPINE-CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3. The earliest affected version is 3.6.4 2018-09-24 because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS...

CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3. The earliest affected version is 3.6.4 2018-09-24 because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS...

UBUNTU-CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3. The earliest affected version is 3.6.4 2018-09-24 because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS...

CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 is affected by a flaw in how the TLS session-ticket encryption key is constructed, caused by an 2018-09-18 commit. The earliest affected version is 3.6.4 . Until the first key rotation, the TLS server uses incorrect data in place of a key derived from the application, l...

PT-2020-13675 · Gnu +7 · Gnutls +7

Name of the Vulnerable Software and Affected Versions: GnuTLS versions 3.6.4 through 3.6.14 Description: The issue is related to incorrect cryptography used for encrypting a session ticket, leading to a loss of confidentiality in TLS 1.2 and an authentication bypass in TLS 1.3. This allows an...

osTicket 1.14.1 - (Ticket Queue) Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: osTicket 1.14.1 - 'Ticket Queue' Persistent Cross-Site Scripting Exploit Author: Matthew Aberegg Vendor Homepage: https://osticket.com Patch Link:...

osTicket 1.14.1 - 'Ticket Queue' Persistent Cross-Site Scripting

Exploit Title: osTicket 1.14.1 - 'Ticket Queue' Persistent Cross-Site Scripting Date: 2020-05-26 Exploit Author: Matthew Aberegg Vendor Homepage: https://osticket.com Patch Link: https://github.com/osTicket/osTicket/commit/6c724ea3fe352d10d457d334dc054ef81917fde1 Version: osTicket 1.14.1 Tested o...

InnoGames: Impersonation and ticket id enumeration on support.innogames.com

A missing check for authorization made it possible to answer tickets owned by other users in their own name...

CVE-2020-11036

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert1" reproduces the attack. This can be exploited by a user with administrator privileges i...

Cross site scripting

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert1" reproduces the attack. This can be exploited by a user with administrator privileges i...

CVE-2020-11036 XSS in GLPI

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert1" reproduces the attack. This can be exploited by a user with administrator privileges i...

Open Ticket Request System Information Disclosure Vulnerability (CNVD-2020-32426)

Open Ticket Request System OTRS is an open source defect tracking and management system software from the German OTRS Group. The software categorizes service requests submitted through various channels such as phone calls, emails, etc. into different queues and service levels, and the service...

TiTok - Ticket Token Flawed Logic Vulnerability

TiTok - Ticket Token is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function in the implementation of TiTok - Ticket Token's smart contract contract name: MyAdvancedToken7. An attacker could exploit this vulnerability to prevent the seller from accessin...

Support Ticket System By Phoeniixx <= 2.7 - Unauthenticated Reflected XSS

Bad user input sanitisation leads to unauthenticated reflected XSS. Edit WPScanTeam: January 27th, 2020 - Report received & WP Plugin team notified January 31st, 2020 - WP plugin team acknowledgement & plugin closed. April 11th, 2020 - No updates, disclosing...

WordPress Support Ticket System By Phoeniixx <= 2.7 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered Max in WordPress Support Ticket System By Phoeniixx versions = 2.7. Solution This plugin has been closed as of January 31, 2020 and is not available for download. Reason: Security Issue...

Support Ticket System By Phoeniixx <= 2.7 - Unauthenticated Reflected XSS

Bad user input sanitisation leads to unauthenticated reflected XSS. Edit WPScanTeam: January 27th, 2020 - Report received & WP Plugin team notified January 31st, 2020 - WP plugin team acknowledgement & plugin closed. April 11th, 2020 - No updates, disclosing. PoC...

Unspecified Vulnerability in Deskpro (CNVD-2020-22254)

Deskpro is a helpdesk software solution that helps companies manage communication with their customers and user base across multiple channels. Deskpro has a security vulnerability that can be exploited by an attacker to leak ticket authentication code, which can be used to make changes to tickets...