Windows Escalate Golden Ticket

This module will create a Golden Kerberos Ticket using the Mimikatz Kiwi Extension. If no options are applied it will attempt to identify the current domain, the domain administrator account, the target domain SID, and retrieve the krbtgt NTLM hash from the database. By default the well-known...

CVE-2015-1347

CVE-2015-1347 affects the osTicket project: a cross-site scripting (XSS) vulnerability in the file client.inc.php in versions before 1.9.5.1, exploitable via the lang parameter. The available connected documents confirm the issue and reference the fix in v1.9.5.1. Impact is remote script/HTML inj...

SUSE-SU-2015:0290-1 Security update for krb5

MIT kerberos krb5 was updated to fix several security issues and bugs. Security issues fixed: CVE-2014-5351: The kadm5randkeyprincipal3 function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 sent old keys in a response to a -randkey -keepold request, which allowed remote...

IBM General Parallel File System Multiple Vulnerabilities (Windows) (POODLE)

A version of IBM General Parallel File System GPFS 3.5.x prior to 3.5.0.21 is installed on the remote Windows host. It is, therefore, affected by the following OpenSSL related vulnerabilities : - An error exists related to DTLS SRTP extension handling and specially crafted handshake messages that...

MGASA-2015-0031 Updated otrs package fixes CVE-2014-9324

Updated otrs package fixes security vulnerability: An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured CVE-2014-9324...

Directory traversal

Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the attach parameter to WorkOrder.do in the file attachment for a new ticket...

[SECURITY] [DSA 3124-1] otrs2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3124-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso January 10, 2015 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 3124-1 (otrs2 - security update)

Thorsten Eckel of Znuny GMBH and Remo Staeuble of InfoGuard discovered a privilege escalation vulnerability in otrs2, the Open Ticket Request System. An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is...

Phone to grab votes APP“train up”to the presence of high-risk vulnerabilities in the user's personal information and other data leaks-bug warning-the black bar safety net

Data 3 6 0 patch-day vulnerability response platform shows that the domestic popular mobile phone to grab votes APP“train up”to the presence of high-risk vulnerabilities, including millions of tickets, ticket orders user ID number, username, plaintext password, detailed ticket information and oth...

Windows-Kerberos-MS14-068

Microsoft Windows Server contains a flaw related to the checksum in the Kerberos Key Distribution Center KDC component. The issue is triggered when the component fails to properly validate signatures. This may allow an authenticated remote attacker to use a forged Kerberos ticket signature to gai...

F5 Networks BIG-IP : OpenSSL vulnerability (SOL15723)

Memory leak in the tlsdecryptticket function in t1lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service memory consumption via a crafted session ticket that triggers an integrity-check failure. CVE-2014-3567 C Tenable...

OTRS Help Desk Security Mechanism Bypass Vulnerability

OTRS Help Desk is an open source resource service management solution. A security mechanism bypass vulnerability exists in OTRS Help Desk versions 3.2.x prior to 3.2.17, 3.3.x prior to 3.3.11, and 4.0.x prior to 4.0.3, which allows remote authenticated users to access and modify arbitrary tickets...

OTRS 3.2.x < 3.2.17, 3.3.x < 3.3.11, 4.x < 4.0.3 Help Desk Privilege Escalation Vulnerability (Dec 2014)

Open Ticket Request System OTRS Help Desk is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

MS14-068 Microsoft Kerberos Checksum Validation Vulnerability

This module exploits a vulnerability in the Microsoft Kerberos implementation. The problem exists in the verification of the Privilege Attribute Certificate PAC from a Kerberos TGS request, where a domain user may forge a PAC with arbitrary privileges, including Domain Administrator. This module...

DEBIAN-CVE-2014-9324

The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors...

CVE-2014-9324

The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors...

Updated krb5 packages fix CVE-2014-5353

Updated krb5 packages fix security vulnerability: In MIT krb5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause a NULL dereference by attempting to use a named ticket policy object as a password policy for a principal. The attacker needs to b...

CVE-2014-9324

CVE-2014-9324 affects OTRS Help Desk: GenericInterface access-control problems allow remote authenticated users to access and modify ticket data. Affected versions are OTRS 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3. Consequences include unauthorized ticket data access/manip...

otrs -- Incomplete Access Control

The OTRS project reports: An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured...

CVE-2014-9179

Cross-site scripting XSS vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the "URL optional" field in a new ticket...