CVE-2015-1176

MediumCVSS 4.3/10Last modified Jul 10, 2026

Description

Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 23, 2015
Last modified
Jul 10, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-11776.1Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.CVE-2015-11784.3Multiple cross-site scripting (XSS) vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web sCVE-2015-11794.3Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers CVE-2015-11804.3Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HCVE-2015-11827.5The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initializeCVE-2015-11879.8The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.cCVE-2015-11887.5The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows rCVE-2015-11915.0Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2)CVE-2015-11925.0Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archCVE-2015-11935.0Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname orCVE-2015-11944.3pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.CVE-2015-11956.5The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticate
CVE-2015-1176: Medium severity, CVSS 4.3 | Vulnix