3420 matches found
Design/Logic Flaw
Agent A is able to save a draft i.e. for customer reply. Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: OTRS Community Edition 6.0.x version...
UBUNTU-CVE-2020-1766
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...
CVE-2020-1767
Agent A is able to save a draft i.e. for customer reply. Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: OTRS Community Edition 6.0.x version...
UBUNTU-CVE-2020-1767
Agent A is able to save a draft i.e. for customer reply. Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: OTRS Community Edition 6.0.x version...
CVE-2020-1767
Agent A is able to save a draft i.e. for customer reply. Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: OTRS Community Edition 6.0.x version...
CVE-2020-1767 Possible to send drafted messages as wrong agent
Agent A is able to save a draft i.e. for customer reply. Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: OTRS Community Edition 6.0.x version...
CVE-2020-1766 Improper handling of uploaded inline images
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...
CVE-2020-1766
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...
PT-2020-15044 · Otrs +1 · Otrs Community Edition +2
Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 6.0.24 and prior versions OTRS versions 7.0.13 and prior versions Description: The issue allows one agent to send a message in the name of another agent, without the customer being aware of the change. This is...
PT-2020-15042 · Otrs +2 · Otrs Community Edition +2
Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 5.0.0 through 5.0.39 OTRS Community Edition versions 6.0.0 through 6.0.24 OTRS Community Edition versions 7.0.0 through 7.0.13 Description: The issue allows for the spoofing of the 'from' fields in several...
PT-2020-15043 · Otrs +2 · Otrs Community Edition +2
Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 5.0.39 and prior versions OTRS Community Edition versions 6.0.24 and prior versions OTRS Community Edition versions 7.0.13 and prior versions Description: The issue arises from improper handling of uploaded...
Security Bulletin: A security vulnerability has been identified in Werkzeug shipped with PowerAI.
Summary Vulnerability CVE-2019-14806 in Werkzeug package. Vulnerability Details CVEID: CVE-2019-14806 DESCRIPTION: Pallets Werkzeug versions prior to 0.15.3 used with Docker have insufficient debugger PIN randomness because Docker containers share the same machine ID. CVSS Base score: 7.5 CVSS...
GitLab Denial of Service Vulnerability (CNVD-2020-03231)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...
GitLab Unauthorized Access Vulnerability (CNVD-2020-03230)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...
GitLab Access Control Error Vulnerability (CNVD-2020-01912)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...
UBUNTU-CVE-2019-18179
An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23. An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, even tickets in a queue where the attacker doesn'...
CVE-2019-19257
GitLab Community Edition CE and Enterprise Edition EE through 12.5 has Incorrect Access Control issue 1 of 2...
CVE-2019-19257
GitLab Community Edition CE and Enterprise Edition EE through 12.5 has Incorrect Access Control issue 1 of 2...