PT-2011-3128

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.6 Description The issue in OTRS allows context-dependent attackers to obtain sensitive information. This is due to the AgentInterface and CustomerInterface components placing cleartext...

CVE-2008-7280: Improper Input Validation

Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System OTRS before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service e-mail retrieval outage via a crafted message...

PT-2011-1714

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.4.8 Description A race condition exists in the Kernel::System::Main::FileWrite method, allowing remote authenticated users to corrupt the TicketCounter.log data in certain circumstances by...

CVE-2010-4763: Undefined Security Weakness

The ACL-customer-status Ticket Type setting in Open Ticket Request System OTRS before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the 1 Status, 2 Service, and 3 Queue via selections...

CVE-2008-7283: Undefined Security Weakness

Open Ticket Request System OTRS before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions...

CVE-2008-7279: Undefined Security Weakness

The CustomerInterface component in Open Ticket Request System OTRS before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors...

CVE-2010-4764: Undefined Security Weakness

Open Ticket Request System OTRS before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages that were based on revoked PGP or GPG keys, which makes it easier for remote attackers to spoof e-mail communication by leveraging a key that has a revocation...

CVE-2008-7282: Undefined Security Weakness

Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System OTRS before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain 1 list and 2...

CVE-2010-4762: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the rich-text-editor component in Open Ticket Request System OTRS before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface...

PT-2011-1707

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.3 Description The issue concerns the installer.pl in Open Ticket Request System OTRS, where the Inbound Mail Password field uses the text type instead of the password type for its INPUT...

PT-2011-1709

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta6 Description The issue allows remote authenticated users to obtain potentially sensitive information by reading a ticket, due to the addition of email-notification-ext articles to...

PT-2011-1713

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 2.4.9 and earlier Open Ticket Request System OTRS versions 3.x before 3.0.3 Description The issue concerns the handling of incoming encrypted e-mail messages based on revoked PGP or GPG keys. It does no...

PT-2011-1274

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.2.7 Description The issue allows remote attackers to obtain potentially sensitive e-mail address information. This is achieved by reading the Bcc header field in e-mails sent by the system,...

DEBIAN-CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

PT-2011-2359

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 2.3.4 and earlier Description The issue allows remote attackers to execute arbitrary commands via unspecified vectors, related to a command injection vulnerability. Recommendations For OTRS versions 2.3...

CVE-2011-0456: Improper Neutralization of Special Elements used in an OS Command

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...