CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2020-12629
https://notcve.org/view.php?id=CVE-2020-12629
04 May 2020 — include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name. En el archivo include/class.sla.php en osTicket versiones anteriores a la versión 1.14.2, permite un ataque de tipo XSS por medio del Nombre SLA. • https://github.com/mkelepce/CVE-2020-12629 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 2CVE-2019-14748 – osTicket 1.12 - Persistent Cross-Site Scripting via File Upload
https://notcve.org/view.php?id=CVE-2019-14748
07 Aug 2019 — An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment. Se det... • https://www.exploit-db.com/exploits/47224 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 3%CPEs: 2EXPL: 1CVE-2019-14749 – osTicket 1.12 - Formula Injection
https://notcve.org/view.php?id=CVE-2019-14749
07 Aug 2019 — An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and OpenOffice Cal... • https://www.exploit-db.com/exploits/47225 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.1EPSS: 10%CPEs: 2EXPL: 1CVE-2019-14750 – osTicket 1.12 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-14750
07 Aug 2019 — An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions. • https://www.exploit-db.com/exploits/47226 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13397
https://notcve.org/view.php?id=CVE-2019-13397
09 Jul 2019 — Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket. Un problema de tipo XSS almacenado no identificado en osTicket versión 1.10.1, permite a un atacante remoto alcanzar privilegios de administrador al inyectar un script web o HTML arbitrario por medio de una extensión de archivo arbitraria durante la creación de un ticket de soporte. • https://medium.com/%40sarapremashish/osticket-1-10-1-unauthenticated-stored-xss-allows-an-attacker-to-gain-admin-privileges-6a0348761a3a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-11537 – osTicket 1.11 - Cross-Site Scripting / Local File Inclusion
https://notcve.org/view.php?id=CVE-2019-11537
25 Apr 2019 — In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion. En osTicket versiones anteriores a 1.12, tiene una vulnerabilidad de Cross-Site Scripting (XSS) a través de /upload/file.php, /upload/scp/users.php?do=import-users, y /upload/scp/ajax.php/users/import si un... • https://www.exploit-db.com/exploits/46753 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7193
https://notcve.org/view.php?id=CVE-2018-7193
27 Mar 2018 — Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter. Vulnerabilidad de Cross-Site Scripting (XSS) en /scp/directory.php en Enhancesoft osTicket, en versiones anteriores a la 1.10.2, permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el parámetro "order". • https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7196
https://notcve.org/view.php?id=CVE-2018-7196
27 Mar 2018 — Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. Vulnerabilidad de Cross-Site Scripting (XSS) en /scp/index.php en Enhancesoft osTicket, en versiones anteriores a la 1.10.2, permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el parámetro "sort". • https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7194
https://notcve.org/view.php?id=CVE-2018-7194
27 Mar 2018 — Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting. Vulnerabilidad de formato de enteros en el generador de números de ticket en versiones anteriores a la 1.10.2 de Enhancesoft osTicket permite que atacantes remotos provoquen una denegación de servicio (evitando la creación de nuevos tickets) mediante un ... • https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7195
https://notcve.org/view.php?id=CVE-2018-7195
27 Mar 2018 — Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number. Enhancesoft osTicket en versiones anteriores a la 1.10.2 permite que atacantes remotos restablezcan contraseñas arbitrarias (cuando se conoce una dirección de correo electrónico asociada), aprovechando el acceso de invitado y adivinando un número de 6 dígitos. • https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c •