lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <00f3f362-d61c-c447-7c66-2968ebcdc8c3@securify.nl>
Date: Tue, 28 Feb 2017 18:19:11 +0100
From: "Securify B.V." <lists@...urify.nl>
To: bugtraq@...urityfocus.com
Subject: Multiple persistent Cross-Site Scripting vulnerabilities in osTicket

------------------------------------------------------------------------
Multiple persistent Cross-Site Scripting vulnerabilities in osTicket
------------------------------------------------------------------------
Han Sahin, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
Two persistent Cross-Site Scripting vulnerabilities have been found in
osTicket. These issues exists due to the lack of output encoding on user
input. These vulnerabilities allow an attacker to inject malicious
JavaScript code into the application. This code will then be executed
within the browser of a user who views the dashboard. The
attacker-supplied code can perform a wide variety of actions, such as
stealing victims' session tokens or login credentials, performing
arbitrary actions on their behalf.

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
These issues were successfully tested on osTicket version 1.9.12.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
osTicket version 1.9.15 and osTicket version 1.10 are released that
address these vulnerabilities.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20160801/multiple_persistent_cross_site_scripting_vulnerabilities_in_osticket.html

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ