CVE-2023-50457

An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions...

Design/Logic Flaw

An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions...

Internet Bug Bounty: curl HSTS long file name clears contents

When saving HSTS data using curl, a vulnerability was found where using an excessively long file name could result in the clearing of all contents. This caused subsequent requests using that file to be unaware of the HSTS status they should have used. The reason was that curl appended a suffix to...

Kerberos Ticket Management

Manage kerberos tickets on a compromised host. Module Options msf use post/windows/manage/kerberostickets msf postkerberostickets show actions ...actions... msf postkerberostickets set ACTION msf postkerberostickets show options ...show and set options... msf postkerberostickets run This module...

inTouch 1.0 File Upload - Remote Code Execution Vulnerability

Title: inTouch-1.0 File Upload - RCE Author: nu11secur1ty Vendor: https://codecanyon.net/user/media-city Software: https://codecanyon.net/item/intouch-laravel-support-ticket-management-system/35177425?srank=2 Reference: https://portswigger.net/web-security/file-upload,...

OTRS Security Vulnerabilities

OTRS is an application from OTRS Germany. A service management software. A security vulnerability exists in OTRS versions 8.0.X through 8.0.37. An attacker exploiting this vulnerability could read a plain text password sent back to the client in a server response...

CVE-2023-33706

SysAid before 23.2.15 allows Indirect Object Reference IDOR attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp...

CVE-2023-33706

SysAid before 23.2.15 allows Indirect Object Reference IDOR attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp...

CVE-2023-33706

SysAid before 23.2.15 allows Indirect Object Reference IDOR attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp...

Sysaid Technologies SysAid Security Vulnerabilities

Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. A security vulnerability exists in Sysaid Technologies SysAid versions prior to 23.2.15 that stems from the presence of an insecure direct object reference IDOR issue that allows an attacker...

Bus Ticket Booking with Seat Reservation < 5.2.6 - Unauthenticated Cross-Site Scripting

Description The Bus Ticket Booking with Seat Reservation – WpBusTicketly | WordPress plugin plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2023-30496 WordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MagePeople Team WpBusTicketly plugin = 5.2.5 versions...

WordPress Plugin WpBusTicketly Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Bus Ticket Booking with Se...

Users can make external storage mount points inaccessible for other users

None...

user_ldap app logs user passwords in the log file on level debug

None...

Admins can change authentication details of user configured external storage

None...

ManageEngine SupportCenter Plus < 14.3 Build 14300

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 14.3 Build 14300. It is, therefore, affected by a vulnerability as referenced in the support-centerCVE-2023-34197 advisory. - Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300,...

ManageEngine SupportCenter Plus < 11.0 Build 11022

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 11.0 Build 11022. It is, therefore, affected by a vulnerability as referenced in the support-centercve-2022-35403 advisory. - Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606,...

ManageEngine ServiceDesk Plus < 13.0 Build 13008

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 13.0 Build 13008. It is, therefore, affected by a vulnerability as referenced in the service-deskcve-2022-35403 advisory. - Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and...

ManageEngine ServiceDesk Plus MSP < 10.6 Build 10606

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 10.6 Build 10606. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspcve-2022-35403 advisory. - Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before...