CVE-2014-1695: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email...

CVE-2014-1694

Multiple cross-site request forgery CSRF vulnerabilities in 1 CustomerPreferences.pm, 2 CustomerTicketMessage.pm, 3 CustomerTicketProcess.pm, and 4 CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow...

DEBIAN-CVE-2014-1471

SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL...

CVE-2014-1471

SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL...

UBUNTU-CVE-2014-1694

Multiple cross-site request forgery CSRF vulnerabilities in 1 CustomerPreferences.pm, 2 CustomerTicketMessage.pm, 3 CustomerTicketProcess.pm, and 4 CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow...

CVE-2014-1471

SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL...

CVE-2014-1694

Multiple cross-site request forgery CSRF vulnerabilities in 1 CustomerPreferences.pm, 2 CustomerTicketMessage.pm, 3 CustomerTicketProcess.pm, and 4 CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow...

CVE-2014-1694

Removed by vendor...

PT-2014-4297

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 3.1.x through 3.1.18 Open Ticket Request System OTRS versions 3.2.x through 3.2.13 Open Ticket Request System OTRS versions 3.3.x through 3.3.3 Description The issue allows remote attackers to hijack th...

PT-2014-4199

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 3.1.x through 3.1.18 Open Ticket Request System OTRS versions 3.2.x through 3.2.13 Open Ticket Request System OTRS versions 3.3.x through 3.3.3 Description A SQL injection issue exists in the...

CVE-2014-1471: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL...

CVE-2014-1694: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in 1 CustomerPreferences.pm, 2 CustomerTicketMessage.pm, 3 CustomerTicketProcess.pm, and 4 CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow...

OTRS Mailbox HTML Injection Vulnerability (OSA-2007-01)

Open Ticket Request System OTRS is prone to a HTML injection vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

OTRS < 3.0.3 Password Disclosure Vulnerability

Open Ticket Request System OTRS is prone to a password disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Debian Security Advisory DSA 2733-1 (otrs2 - SQL injection)

It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise user-supplied data that is used on SQL queries. An attacker with a valid agent login could exploit this issue to craft SQL queries by injecting arbitrary SQL code through manipulated URLs. OpenVAS Vulnerabili...

PT-2020-7477

Name of the Vulnerable Software and Affected Versions: Open Ticket Request System OTRS versions 3.0.x through 3.0.20 Open Ticket Request System OTRS versions 3.1.x through 3.1.16 Open Ticket Request System OTRS versions 3.2.x through 3.2.7 Description: The issue allows remote attackers with a val...

PT-2020-7445

Name of the Vulnerable Software and Affected Versions: Open Ticket Request System OTRS versions 3.0.x through 3.0.19 Open Ticket Request System OTRS versions 3.1.x through 3.1.15 Open Ticket Request System OTRS versions 3.2.x through 3.2.6 OTRS ITSM versions 3.0.x through 3.0.7 OTRS ITSM versions...

PT-2013-1329

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS Help Desk versions 3.0.x through 3.0.21 Open Ticket Request System OTRS Help Desk versions 3.1.x through 3.1.17 Open Ticket Request System OTRS Help Desk versions 3.2.x through 3.2.8 Description The issue is...

Debian Security Advisory DSA 2712-1 (otrs2 - privilege escalation)

It was discovered that users with a valid agent login could use crafted URLs to bypass access control restrictions and read tickets to which they should not have access. The oldstable distribution squeeze is not affected by this problem. OpenVAS Vulnerability Test $Id: deb2712.nasl 6611 2017-07-0...

Debian Security Advisory DSA 2696-1 (otrs2 - privilege escalation)

A vulnerability has been discovered in the Open Ticket Request System, which can be exploited by malicious users to disclose potentially sensitive information. An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets they are not permitte...