Osticket
by Osticket
Source repositories
CVEs (66)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-31890 | Cri | 0.00 | 9.8 | 0.01 | Apr 5, 2023 | SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function. | ||
| CVE-2022-31889 | Med | 0.00 | 6.1 | 0.01 | Apr 5, 2023 | Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae. | ||
| CVE-2022-31888 | Hig | 0.00 | 8.8 | 0.01 | Apr 5, 2023 | Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. | ||
| CVE-2023-1320 | Med | 0.00 | 6.1 | 0.01 | Mar 10, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6. | ||
| CVE-2023-1319 | Med | 0.00 | 4.8 | 0.00 | Mar 10, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6. | ||
| CVE-2023-1318 | Med | 0.00 | 5.4 | 0.01 | Mar 10, 2023 | Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6. | ||
| CVE-2023-1317 | Med | 0.00 | 5.4 | 0.01 | Mar 10, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6. | ||
| CVE-2023-1316 | Med | 0.00 | 5.4 | 0.01 | Mar 10, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6. | ||
| CVE-2023-1315 | Med | 0.00 | 5.4 | 0.01 | Mar 10, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6. | ||
| CVE-2022-4271 | Med | 0.00 | 5.4 | 0.01 | Dec 2, 2022 | Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4. | ||
| CVE-2021-42235 | Cri | 0.00 | 9.8 | 0.01 | May 4, 2022 | SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality. | ||
| CVE-2020-22609 | Med | 0.00 | 6.1 | 0.01 | Jun 28, 2021 | Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php. | ||
| CVE-2020-22608 | Med | 0.00 | 6.1 | 0.01 | Jun 28, 2021 | Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php. | ||
| CVE-2020-12629 | Med | 0.00 | 5.4 | 0.01 | May 4, 2020 | include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name. | ||
| CVE-2015-1347 | 0.00 | — | 0.01 | Jan 23, 2015 | Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. | |||
| CVE-2015-1176 | 0.00 | — | 0.02 | Jan 23, 2015 | Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action. | |||
| CVE-2014-4744 | 0.00 | — | 0.02 | Jul 9, 2014 | Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to… | |||
| CVE-2010-4634 | 0.00 | — | 0.02 | Dec 30, 2010 | Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party | |||
| CVE-2010-0606 | 0.00 | — | 0.01 | Feb 11, 2010 | Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php. | |||
| CVE-2006-5407 | 0.00 | — | 0.01 | Oct 19, 2006 | PHP remote file inclusion vulnerability in open_form.php in osTicket allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter. |
- risk 0.00cvss 9.8epss 0.01
SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function.
- risk 0.00cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae.
- risk 0.00cvss 8.8epss 0.01
Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.
- risk 0.00cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
- risk 0.00cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
- risk 0.00cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.
- risk 0.00cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
- risk 0.00cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
- risk 0.00cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
- risk 0.00cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4.
- risk 0.00cvss 9.8epss 0.01
SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.
- risk 0.00cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php.
- risk 0.00cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php.
- risk 0.00cvss 5.4epss 0.01
include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
- CVE-2015-1347Jan 23, 2015risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
- CVE-2015-1176Jan 23, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action.
- CVE-2014-4744Jul 9, 2014risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to…
- CVE-2010-4634Dec 30, 2010risk 0.00cvss —epss 0.02
Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party
- CVE-2010-0606Feb 11, 2010risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.
- CVE-2006-5407Oct 19, 2006risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in open_form.php in osTicket allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter.
Page 3 of 4