Vendor CVEs
Osticket
All CVEs
66 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-42235 | Cri | 0.00 | 9.8 | 0.01 | May 4, 2022 | SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality. | ||
| CVE-2020-22609 | Med | 0.00 | 6.1 | 0.01 | Jun 28, 2021 | Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php. | ||
| CVE-2020-22608 | Med | 0.00 | 6.1 | 0.01 | Jun 28, 2021 | Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php. | ||
| CVE-2020-12629 | Med | 0.00 | 5.4 | 0.01 | May 4, 2020 | include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name. | ||
| CVE-2015-1347 | 0.00 | — | 0.01 | Jan 23, 2015 | Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. | |||
| CVE-2015-1176 | 0.00 | — | 0.02 | Jan 23, 2015 | Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action. | |||
| CVE-2014-4744 | 0.00 | — | 0.02 | Jul 9, 2014 | Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to… | |||
| CVE-2010-4634 | 0.00 | — | 0.03 | Dec 30, 2010 | Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party | |||
| CVE-2010-0606 | 0.00 | — | 0.01 | Feb 11, 2010 | Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php. | |||
| CVE-2006-5407 | 0.00 | — | 0.01 | Oct 19, 2006 | PHP remote file inclusion vulnerability in open_form.php in osTicket allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter. | |||
| CVE-2005-2153 | 0.00 | — | 0.01 | Jul 6, 2005 | SQL injection vulnerability in class.ticket.php in osTicket 1.3.1 beta and earlier allows remote attackers to execute arbitrary SQL commands via the ticket variable. | |||
| CVE-2005-1439 | 0.00 | — | 0.02 | May 3, 2005 | Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter. | |||
| CVE-2005-1436 | 0.00 | — | 0.02 | May 3, 2005 | Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via (1) the t parameter to view.php, (2) the osticket_title parameter to header.php, (3) the em parameter to admin_login.php, (4) the e parameter to… | |||
| CVE-2005-1438 | 0.00 | — | 0.01 | May 3, 2005 | PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the include_dir parameter. | |||
| CVE-2005-1437 | 0.00 | — | 0.01 | May 3, 2005 | Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to admin.php or (2) cat parameter to view.php. | |||
| CVE-2004-0614 | 0.00 | — | 0.01 | Dec 6, 2004 | osTicket trusts a hidden form field in the submit form to limit the upload size of a document, which could allow remote attackers to upload a file of any size. |
- risk 0.00cvss 9.8epss 0.01
SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.
- risk 0.00cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php.
- risk 0.00cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php.
- risk 0.00cvss 5.4epss 0.01
include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
- CVE-2015-1347Jan 23, 2015risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
- CVE-2015-1176Jan 23, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action.
- CVE-2014-4744Jul 9, 2014risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to…
- CVE-2010-4634Dec 30, 2010risk 0.00cvss —epss 0.03
Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party
- CVE-2010-0606Feb 11, 2010risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.
- CVE-2006-5407Oct 19, 2006risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in open_form.php in osTicket allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter.
- CVE-2005-2153Jul 6, 2005risk 0.00cvss —epss 0.01
SQL injection vulnerability in class.ticket.php in osTicket 1.3.1 beta and earlier allows remote attackers to execute arbitrary SQL commands via the ticket variable.
- CVE-2005-1439May 3, 2005risk 0.00cvss —epss 0.02
Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter.
- CVE-2005-1436May 3, 2005risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via (1) the t parameter to view.php, (2) the osticket_title parameter to header.php, (3) the em parameter to admin_login.php, (4) the e parameter to…
- CVE-2005-1438May 3, 2005risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the include_dir parameter.
- CVE-2005-1437May 3, 2005risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to admin.php or (2) cat parameter to view.php.
- CVE-2004-0614Dec 6, 2004risk 0.00cvss —epss 0.01
osTicket trusts a hidden form field in the submit form to limit the upload size of a document, which could allow remote attackers to upload a file of any size.
Page 2 of 2