CVE-2009-4079: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Redmine 0.8.5 and earlier allows remote attackers to hijack the authentication of users for requests that delete a ticket via unspecified vectors...

Redmine vulnerable to cross-site request forgery

Overview Redmine contains a cross-site request forgery vulnerability. Redmine is a project management software. Redmine contains a cross-site request forgery vulnerability. Yoshinari Fukumoto of Rakuten, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#87341298 Redmine vulnerable to cross-site request forgery

Redmine is a project management software. Redmine contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged into Redmine, an arbitrary ticket may be deleted. Solution Update the Software Update to the latest version according to the information...

cP Creator 'tickets' Cookie SQL Injection Vulnerability

cP Creator is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

Cross-site scripting XSS vulnerability in Kayako SupportSuite 3.50.06 allows remote attackers to inject arbitrary web script or HTML via the subject field in a ticket...

CVE-2009-3427

Cross-site scripting XSS vulnerability in Kayako SupportSuite 3.50.06 allows remote attackers to inject arbitrary web script or HTML via the subject field in a ticket...

Sql injection

SQL injection vulnerability in index.php in cP Creator 2.7.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tickets parameter in a support ticket action...

Kayako SupportSuite Ticket Subject XSS

According to its banner, the version of Kayako SupportSuite installed on the remote host is earlier than 3.60.04. Such versions are affected by a persistent cross-site scripting vulnerability. Specifically, the installed version fails to sanitize input passed to the subject field while creating a...

Ticket Support Script Shell Upload

|| || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection | | // | | |...

Ticket Support Script (ticket.php) Remote Shell Upload Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Ticket Support Script ticket.php Remote Shell Upload Vulnerability ====================================================================...

Ticket Support Script - ticket.php Arbitrary File Upload

Ticket Support Script - ticket.php Arbitrary File Upload || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection | | // |...

Sql injection

SQL injection vulnerability in admin.php in MRCGIGUY The Ticket System 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewticket action...

CVE-2009-2639

SQL injection vulnerability in admin.php in MRCGIGUY The Ticket System 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewticket action...

CVE-2009-2639

CVE-2009-2639 affects MRCGIGUY The Ticket System 2.0 (admin.php) where the viewticket action vulnerable to SQL injection via the id parameter. Root cause is unsafely concatenated SQL in the vulnerable endpoint, enabling remote arbitrary SQL execution. Consequences described are arbitrary SQL comm...

CVE-2009-2639

SQL injection vulnerability in admin.php in MRCGIGUY The Ticket System 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewticket action...

CVE-2009-2639: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin.php in MRCGIGUY The Ticket System 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewticket action...

CVE-2009-2428

Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL commands via the 1 userid parameter to suchauftraegeuser.php and the 2 descr parameter to vote.php; and other unspecified vectors...

Sql injection

Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL commands via the 1 userid parameter to suchauftraegeuser.php and the 2 descr parameter to vote.php; and other unspecified vectors...

CVE-2009-2428

Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL commands via the 1 userid parameter to suchauftraegeuser.php and the 2 descr parameter to vote.php; and other unspecified vectors...

CVE-2009-2428

The CVE-2009-2428 entry concerns the Tausch Ticket Script 3 with multiple SQL injection vulnerabilities. The documented vectors include the (1) userid parameter to suchauftraege_user.php and the (2) descr parameter to vote.php, plus other unspecified vectors. Attack potential is remote, enabling ...