CVE-2010-4763

OTRS before 3.0.0-beta1 is affected by CVE-2010-4763. The ACL-customer-status Ticket Type setting does not restrict options after an AJAX reload, allowing remote authenticated users to bypass ACLs for Status, Service, and Queue via selections. Affected component: OTRS Web UI/ACL logic in the tick...

CVE-2008-7277

Open Ticket Request System OTRS before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets...

CVE-2010-4758

installer.pl in Open Ticket Request System OTRS before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen...

CVE-2010-4760

Open Ticket Request System OTRS before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote authenticated users to obtain potentially sensitive information by reading a ticket...

CVE-2011-1433

The 1 AgentInterface and 2 CustomerInterface components in Open Ticket Request System OTRS before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the UserLogin and UserPW fiel...

CVE-2010-4758

installer.pl in Open Ticket Request System OTRS before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen...

CVE-2010-4761

The customer-interface ticket-print dialog in Open Ticket Request System OTRS before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the 1 responsible, 2 owner, 3 accounted time, 4 pending until...

CVE-2008-7275

OTRS is affected by CVE-2008-7275: pre-2.3.3 versions expose cross-site scripting in the web UI. The vulnerabilities affect the AgentTicketMailbox and CustomerTicketOverView paths (including the OpenVAS entry for OTRS

CVE-2010-4767

Open Ticket Request System OTRS before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset, which allows remote attackers to cause a denial of service duplicate tickets and duplicate auto-response...

PT-2011-1709

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta6 Description The issue allows remote authenticated users to obtain potentially sensitive information by reading a ticket, due to the addition of email-notification-ext articles to...

PT-2011-3128

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.6 Description The issue in OTRS allows context-dependent attackers to obtain sensitive information. This is due to the AgentInterface and CustomerInterface components placing cleartext...

PT-2011-1274

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.2.7 Description The issue allows remote attackers to obtain potentially sensitive e-mail address information. This is achieved by reading the Bcc header field in e-mails sent by the system,...

CVE-2008-7278: Improper Input Validation

The S/MIME feature in Open Ticket Request System OTRS before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available fo...

PT-2011-1707

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.3 Description The issue concerns the installer.pl in Open Ticket Request System OTRS, where the Inbound Mail Password field uses the text type instead of the password type for its INPUT...

PT-2011-1708

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta7 Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon hang, by performing a fulltext search. This is due to the improper...

PT-2011-1713

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 2.4.9 and earlier Open Ticket Request System OTRS versions 3.x before 3.0.3 Description The issue concerns the handling of incoming encrypted e-mail messages based on revoked PGP or GPG keys. It does no...

PT-2011-1712

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta1 Description The issue concerns the ACL-customer-status Ticket Type setting, which fails to restrict ticket options after an AJAX reload. This allows remote authenticated users to...

PT-2011-1710

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta3 Description The issue concerns the customer-interface ticket-print dialog, which fails to properly restrict customer-visible data. This allows remote authenticated users to obtain...

PT-2011-1268

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.3.3 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The attack vectors a...

PT-2011-1271

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.2.5 Open Ticket Request System OTRS versions 2.3.x prior to 2.3.0-beta1 Description The issue is related to the S/MIME feature in OTRS, which does not properly configure the RANDFILE...