Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
osticket osticket vulnerabilities and exploits
(subscribe to this query)
4.9
CVSSv3
CVE-2018-7194
Integer format vulnerability in the ticket number generator in Enhancesoft osTicket prior to 1.10.2 allows remote malicious users to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting.
Osticket Osticket
8.1
CVSSv3
CVE-2018-7195
Enhancesoft osTicket prior to 1.10.2 allows remote malicious users to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number.
Osticket Osticket
NA
CVE-2005-1439
Directory traversal vulnerability in attachments.php in osTicket allows remote malicious users to read arbitrary files via .. sequences in the file parameter.
Osticket Osticket
9.8
CVSSv3
CVE-2020-24881
SSRF exists in osTicket prior to 1.14.3, where an attacker can add malicious file to server or perform port scanning.
Osticket Osticket
6.1
CVSSv3
CVE-2019-11537
In osTicket prior to 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can le...
Osticket Osticket
NA
CVE-2005-1438
PHP remote file inclusion vulnerability in main.php in osTicket allows remote malicious users to execute arbitrary PHP code via the include_dir parameter.
Osticket Osticket 1
6.1
CVSSv3
CVE-2017-15362
osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish co...
Osticket Osticket 1.10.1
9.8
CVSSv3
CVE-2017-15580
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extensio...
Osticket Osticket 1.10.1
1 EDB exploit
NA
CVE-2010-4634
Directory traversal vulnerability in osTicket 1.6 allows remote malicious users to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party
Osticket Osticket 1.6
9.8
CVSSv3
CVE-2017-14396
In osTicket prior to 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.
Osticket Osticket 1.10
1 EDB exploit
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
HTML injection
CVE-2024-35894
SQL
CVE-2024-5105
CVE-2014-100005
CVE-2024-35895
unauthorized
CVE-2024-22120
CVE-2024-35890
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »