CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1319 – Cross-site Scripting (XSS) - Stored in osticket/osticket
https://notcve.org/view.php?id=CVE-2023-1319
10 Mar 2023 — Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6. • https://github.com/osticket/osticket/commit/9fb01bc12fbae06aa2c2b4d1bc9b4a08db4bb3e0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1320 – Cross-site Scripting (XSS) - Stored in osticket/osticket
https://notcve.org/view.php?id=CVE-2023-1320
10 Mar 2023 — Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6. • https://github.com/osticket/osticket/commit/86f9693dc64ed54220ed6c10e13e824ca4f6aacf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4271 – Cross-site Scripting (XSS) - Reflected in osticket/osticket
https://notcve.org/view.php?id=CVE-2022-4271
02 Dec 2022 — Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4. Cross-Site Scripting (XSS) Reflejado en el repositorio de GitHub osticket/osticket antes de 1.16.4. • https://github.com/osticket/osticket/commit/5213ff138c6be6144a6692376ac0803a42eca168 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-42235
https://notcve.org/view.php?id=CVE-2021-42235
04 May 2022 — SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality. Una inyección SQL en el proceso de inicio de sesión y restablecimiento de contraseña de osTicket versiones anteriores a 1.14.8 y 1.15.4, permite a atacantes acceder a la funcionalidad osTicket administration profile • https://github.com/osTicket/osTicket/commit/e28291022e662ffa754e170c09cade7bdadf3fd9 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-22609
https://notcve.org/view.php?id=CVE-2020-22609
28 Jun 2021 — Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en Enhancesoft osTicket versiones anteriores a v1.12.6, por medio del parámetro queue-name en el archivo include/class.queue.php • https://github.com/osTicket/osTicket/commit/6c724ea3fe352d10d457d334dc054ef81917fde1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-22608
https://notcve.org/view.php?id=CVE-2020-22608
28 Jun 2021 — Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php. Una vulnerabilidad de tipo Cross Site Scripting en Enhancesoft osTicket versiones anteriores a v1.12.6, por medio del parámetro queue-name en el archivo include/ajax.search.php • https://github.com/osTicket/osTicket/commit/d54cca0b265128f119b6c398575175cb10cf1754 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-14012
https://notcve.org/view.php?id=CVE-2020-14012
10 Jun 2020 — scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. The attacker must be an Agent. El archivo scp/categories.php en osTicket versión 1.14.2, permite un ataque de tipo XSS por medio de Knowledgebase Category Name o Category Description. El atacante debe ser un Agente • https://github.com/osTicket/osTicket/issues/5514 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2020-12629
https://notcve.org/view.php?id=CVE-2020-12629
04 May 2020 — include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name. En el archivo include/class.sla.php en osTicket versiones anteriores a la versión 1.14.2, permite un ataque de tipo XSS por medio del Nombre SLA. • https://github.com/mkelepce/CVE-2020-12629 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13397
https://notcve.org/view.php?id=CVE-2019-13397
09 Jul 2019 — Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket. Un problema de tipo XSS almacenado no identificado en osTicket versión 1.10.1, permite a un atacante remoto alcanzar privilegios de administrador al inyectar un script web o HTML arbitrario por medio de una extensión de archivo arbitraria durante la creación de un ticket de soporte. • https://medium.com/%40sarapremashish/osticket-1-10-1-unauthenticated-stored-xss-allows-an-attacker-to-gain-admin-privileges-6a0348761a3a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 25EXPL: 2CVE-2014-4744
https://notcve.org/view.php?id=CVE-2014-4744
09 Jul 2014 — Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php. Múltiples vulnerabilidades de XSS en osTicket anterior a 1.9.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de los parámetros (1) Phone Number field en open.php o (2) Phone number f... • http://secunia.com/advisories/59539 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •