DSA-973-1 otrs - several

Bulletin has no description...

CVE-2005-4427

Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the 1 fileid parameter to attachmentsend.php, 2 the $addy variable in emailparser.php, 3 $address variable in emailparser.php, 4 $aaddress variable in structs.php, 5 kbid...

CVE-2005-3980

SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter...

DEBIAN-CVE-2005-3980

SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter...

EdgewallSQL.txt

Edgewall Trac SQL Injection Vulnerability Trac is an enhanced wiki and issue tracking system for software development project. It provides an interface to Subversion. More information on http://projects.edgewall.com/trac/ Description: Malicious user can conduct SQL injection in ticket query modul...

Edgewall Trac SQL Injection Vulnerability

Edgewall Trac SQL Injection Vulnerability Trac is an enhanced wiki and issue tracking system for software development project. It provides an interface to Subversion. More information on http://projects.edgewall.com/trac/ Description: Malicious user can conduct SQL injection in ticket query modul...

CVE-2005-3895

Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary w...

CVE-2005-3894

Multiple cross-site scripting XSS vulnerabilities in index.pl in Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 hex-encoded values in the QueueID parameter and 2 Action parameters...

CVE-2005-3894

Multiple cross-site scripting XSS vulnerabilities in index.pl in Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 hex-encoded values in the QueueID parameter and 2 Action parameters...

EUVD-2005-3888

Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 user parameter in the Login action, and remote authenticated users via the...

CVE-2005-3895

OTRS vulnerability CVE-2005-3895 affects Open Ticket Request System versions 1.0.0–1.3.2 and 2.0.0–2.0.3. When AttachmentDownloadType is inline, text/html email attachments are rendered as HTML in the browser by the queue moderator during download, enabling remote execution of script/HTML (XSS). ...

CVE-2005-3895

Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary w...

namesXSS.txt

names.co.uk is an English registrar and web hosting company. Their frames-based hosting option has an XSS vulnerability allowing injection of arbitrary Javascript. For example: http://www.weddingbiz.co.uk/%22%3E%3Cframe%20src%3D%22javascript%3Aalert%281%29%22%20 According to webhosting.info,...

CVSTrac invalid ticket DoS

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to invalid tickets that may allow an attacker to cause the application to crash. An attacker, exploiting this flaw, would be able to remotely shut down the...

CVE-2005-1672

Multiple cross-site scripting XSS vulnerabilities in Help Center Live allow remote attackers to inject arbitrary web script or HTML via the 1 find parameter to index.php, 2 name or 3 message field of a chat request, or 4 the message body when opening a trouble ticket...

CVE-2005-1672

Help Center Live (PHP-based live help desk with a MySQL backend) is affected by multiple cross-site scripting (XSS) vulnerabilities identified as CVE-2005-1672. The XSS can be triggered by untrusted input in several fields: the find parameter to index.php, the name or message field of a chat requ...

CVE-2005-1672

Multiple cross-site scripting XSS vulnerabilities in Help Center Live allow remote attackers to inject arbitrary web script or HTML via the 1 find parameter to index.php, 2 name or 3 message field of a chat request, or 4 the message body when opening a trouble ticket...

CVE-2005-1446

SitePanel 2.6.1 and earlier SitePanel2 allows remote attackers to upload and execute arbitrary files such as PHP scripts via an attachment to a trouble ticket...

CVE-2005-1446

SitePanel 2.6.1 and earlier SitePanel2 allows remote attackers to upload and execute arbitrary files such as PHP scripts via an attachment to a trouble ticket...

CVE-2004-1467

Multiple cross-site scripting XSS vulnerabilities in eGroupWare 1.0.00.003 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 date or search text field in the calendar module, 2 Field parameter, Filter parameter, QField parameter, Start parameter or Search field in th...