Search
Search Results (34 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-27149 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom list. | ||||
| CVE-2023-27148 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter. | ||||
| CVE-2021-45811 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 6.5 Medium |
| A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination. | ||||
| CVE-2021-42235 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 9.8 Critical |
| SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality. | ||||
| CVE-2020-24917 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 6.1 Medium |
| osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php. | ||||
| CVE-2020-22609 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 6.1 Medium |
| Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php. | ||||
| CVE-2020-22608 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 6.1 Medium |
| Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php. | ||||
| CVE-2020-16193 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 5.4 Medium |
| osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call. | ||||
| CVE-2020-14012 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 5.4 Medium |
| scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. The attacker must be an Agent. | ||||
| CVE-2020-12629 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | 5.4 Medium |
| include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name. | ||||
| CVE-2019-14750 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | N/A |
| An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions. | ||||
| CVE-2019-13397 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | N/A |
| Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket. | ||||
| CVE-2018-7195 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | N/A |
| Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number. | ||||
| CVE-2018-7194 | 1 Enhancesoft | 1 Osticket | 2024-11-21 | N/A |
| Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting. | ||||