DEBIAN-CVE-2019-9752

An issue was discovered in Open Ticket Request System OTRS 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This ...

DEBIAN-CVE-2018-20800

An issue was discovered in Open Ticket Request System OTRS 5.0.31 and 6.0.13. Users updating to 6.0.13 also patchlevel updates or 5.0.31 only major updates will experience data loss in their agent preferences table...

CVE-2019-9751

The CVE-2019-9751 vulnerability affects Open Ticket Request System (OTRS). Affects OTRS 6.x prior to version 6.0.17 and 7.x prior to 7.0.5. The issue arises from Kernel/Output/Template/Document.pm, where an admin-user can manipulate the URL to cause JavaScript execution in the OTRS context. Impac...

CVE-2018-20800

OTRS CVE-2018-20800 affects Open Ticket Request System versions 5.0.31 and 6.0.13. Upgrading to 6.0.13 (or 5.0.31 in some patch paths) may cause data loss in the agent preferences table. The provided documents do not include a concrete root cause analysis or a vendor patch/mitigation, and while m...

March 12, 2019—KB4489880 (Monthly Rollup)

None None...

March 12, 2019—KB4489878 (Monthly Rollup)

None None...

Security advisory YSA-2019-02 | Yubico

Who should read this advisory? Customers, IT Managers, or FIPS Crypto Officers who use or manage YubiKey FIPS Series devices. An issue exists in YubiKey FIPS Series devices, versions 4.4.2 and 4.4.4 please note, there is no released firmware version 4.4.3. , where the first set of random values...

[SECURITY] Fedora 29 Update: pagure-5.3-1.fc29

Pagure is a light-weight git-centered forge based on pygit2. Currently, Pagure offers a web-interface for git repositories, a ticket system and possibilities to create new projects, fork existing ones and create/merge pull-requests across or within projects...

GitLab: Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.com

Summary: Lack of proper ticket trick security leads to internal access on Gitlab instances. I did not use support.gitlab.com instead just using [email protected] email was suffice. Description: Getting a [email protected] Google Account After the Ticket Trick attack that Inti reported and...

qdPM 9.1 - 'search_by_extrafields[]' SQL Injection

=========================================================================================== Exploit Title: qdPM 9.1 - 'searchbyextrafields' SQL Injection Date: 14-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

CVE-2019-1000015

Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting XSS vulnerability in main/messages/newmessage.php, main/social/personaldata.php, main/inc/lib/TicketManager.php, main/ticket/ticketdetails.php that can result in a message being sent to the Administrator with the XSS t...

CVE-2019-1000015

Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting XSS vulnerability in main/messages/newmessage.php, main/social/personaldata.php, main/inc/lib/TicketManager.php, main/ticket/ticketdetails.php that can result in a message being sent to the Administrator with the XSS t...

Improper access control

Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all tickets available on the platform, due to lack of access controls. This attack appears to be exploitable via ticketid=ticket...

CVE-2019-1000015

Chamilo LMS (version 1.11.8 and earlier) contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, and main/ticket/ticket_details.php. The issue can cause a message to be sent to the Administrator with an X...

CB Customer Spotlight: Q&A with Ritter Insurance Marketing’s Dan McLellan

Dan McLellan is a Network Support Specialist at Ritter Insurance Marketing, and uses the Carbon Black community to increase his security knowledge and share information with his colleagues. Having access to insights from other security professionals has not only shortened the time he spends tryin...

ticket-compare.com XSS vulnerability

Open Bug Bounty ID: OBB-716739 Description| Value ---|--- Affected Website:| ticket-compare.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...

DEBIAN-CVE-2018-20217

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 aka krb5 before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type single-DES, triple-DES, or RC4, the attacker can crash the KDC by making an S4U2Self request...

UBUNTU-CVE-2018-20217

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 aka krb5 before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type single-DES, triple-DES, or RC4, the attacker can crash the KDC by making an S4U2Self request...

Open Ticket Request System Cross-Site Scripting Vulnerability (CNVD-2019-09606)

Open Ticket Request System OTRS is an open source defect tracking and management system software. A cross-site scripting vulnerability exists in OTRS version 6.0.x prior to 6.0.13, which can be exploited by remote attackers to execute JavaScript code via URL manipulation...

Open Ticket Request System (OTRS) File Deletion Vulnerability

Open Ticket Request System OTRS is an open source defect tracking and management system software. Open Ticket Request System OTRS suffers from a file deletion vulnerability that can be exploited by an attacker to delete files through manipulation of submission forms...