PT-2011-1714

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.4.8 Description A race condition exists in the Kernel::System::Main::FileWrite method, allowing remote authenticated users to corrupt the TicketCounter.log data in certain circumstances by...

CVE-2010-4763: Undefined Security Weakness

The ACL-customer-status Ticket Type setting in Open Ticket Request System OTRS before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the 1 Status, 2 Service, and 3 Queue via selections...

CVE-2008-7283: Undefined Security Weakness

Open Ticket Request System OTRS before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions...

CVE-2008-7279: Undefined Security Weakness

The CustomerInterface component in Open Ticket Request System OTRS before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors...

CVE-2008-7282: Undefined Security Weakness

Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System OTRS before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain 1 list and 2...

CVE-2010-4762: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the rich-text-editor component in Open Ticket Request System OTRS before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface...

CVE-2009-5056: Improper Input Validation

Open Ticket Request System OTRS before 2.4.0-beta2 does not properly enforce the moveinto permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-ticket...

PT-2011-1707

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.3 Description The issue concerns the installer.pl in Open Ticket Request System OTRS, where the Inbound Mail Password field uses the text type instead of the password type for its INPUT...

PT-2011-1709

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta6 Description The issue allows remote authenticated users to obtain potentially sensitive information by reading a ticket, due to the addition of email-notification-ext articles to...

PT-2011-1713

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 2.4.9 and earlier Open Ticket Request System OTRS versions 3.x before 3.0.3 Description The issue concerns the handling of incoming encrypted e-mail messages based on revoked PGP or GPG keys. It does no...

PT-2011-1274

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.2.7 Description The issue allows remote attackers to obtain potentially sensitive e-mail address information. This is achieved by reading the Bcc header field in e-mails sent by the system,...

PT-2011-1271

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.2.5 Open Ticket Request System OTRS versions 2.3.x prior to 2.3.0-beta1 Description The issue is related to the S/MIME feature in OTRS, which does not properly configure the RANDFILE...

CVE-2010-4759: Improper Input Validation

Open Ticket Request System OTRS before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to cause a denial of service daemon hang via a fulltext search...

DEBIAN-CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

PT-2011-2359

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 2.3.4 and earlier Description The issue allows remote attackers to execute arbitrary commands via unspecified vectors, related to a command injection vulnerability. Recommendations For OTRS versions 2.3...

CVE-2011-0456: Improper Neutralization of Special Elements used in an OS Command

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...