4692 matches found
Code injection
Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permissions...
CVE-2010-5108
The provided connected documents confirm a concrete vulnerability: Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. The root cause is an improper permission check during workflow transitions, which could let an attacker change a ticket’s status and resolution wi...
Trint Ltd: SSO bypass in zendesk using trint organization able to leak internal ticket information
Summary hello there because in app.trint.com there's no email verification i able to login in your zendesk SSO using your organization your organization using domain @trint.com because there's no email verification i able to read and takeover + claim this email [email protected] and i able to...
Quest Software KACE Systems Management Appliance Server Center SQL Injection Vulnerability (CNVD-2020-20171)
Quest Software KACE Systems Management Appliance SMA is a systems management appliance from Quest Software, USA. It supports IT asset management, server management and monitoring, software license management, patch management, etc. Server Center is one of the help desk programs. Quest Software KA...
CVE-2019-13081
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via the title field in the /common/ticketassociatedtickets.php service desk ticket functionality that allows an authenticated user to execute arbitrary JavaScript in a service desk user's browser...
CVE-2019-13076
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...
Design/Logic Flaw
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via the title field in the /common/ticketassociatedtickets.php service desk ticket functionality that allows an authenticated user to execute arbitrary JavaScript in a service desk user's browser...
CVE-2019-13076
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...
CVE-2019-13076
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...
PT-2020-9824 · Otrs +2 · Otrs +2
Name of the Vulnerable Software and Affected Versions: Open Ticket Request System OTRS versions 7.0.x through 7.0.11 Open Ticket Request System OTRS Community Edition versions 5.0.x through 5.0.37 Open Ticket Request System OTRS Community Edition versions 6.0.x through 6.0.22 Description: An issu...
October 15, 2019—KB4520015 (Preview of Monthly Rollup)
None None...
Insecure Randomness
Overview org.apereo.cas:cas-server-support-oauth-core-api is a CAS Server Support OAuth Core API for supporting OAuth within Apereo CAS. Affected versions of this package are vulnerable to Insecure Randomness. A insecure source of randomness is used to generate all of its random values as it reli...
Insecure Randomness
Overview org.apereo.cas:cas-server-core-services-api is a library used within Apereo CAS for Apereo CAS Core Services API. Affected versions of this package are vulnerable to Insecure Randomness. A insecure source of randomness is used to generate all of its random values as it relies upon apache...
Insecure Randomness
Overview org.apereo.cas:cas-server-support-simple-mfa is an is package that allows Apereo CAS to act as a multifactor authentication provider on its own, issuing tokens and sending them to end-users via pre-defined communication channels such as email or text messages. Affected versions of this...
CVE-2016-10969
The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title...
CVE-2016-10969
The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title...
CVE-2016-10970
The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt...
CVE-2016-10970
The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt...