Threats tagged 'ghsa-8whf-jvmp-ghv3'

RTIR's ticket creation forms improperly render the subject of related tickets without HTML escaping when splitting a ticket or creating an incident from a report. This allows an attacker who can send an email report to inject script code in the ticket subject, which executes in the session of the incident handler who processes the ticket. The vulnerability was fixed in RTIR version 6.0.4; version 5.0 is not affected.