CVE-2010-4759: Improper Input Validation

Open Ticket Request System OTRS before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to cause a denial of service daemon hang via a fulltext search...

CVE-2008-7283: Undefined Security Weakness

Open Ticket Request System OTRS before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions...

CVE-2008-7280: Improper Input Validation

Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System OTRS before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service e-mail retrieval outage via a crafted message...

CVE-2008-7279: Undefined Security Weakness

The CustomerInterface component in Open Ticket Request System OTRS before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors...

PT-2011-3128

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.6 Description The issue in OTRS allows context-dependent attackers to obtain sensitive information. This is due to the AgentInterface and CustomerInterface components placing cleartext...

CVE-2008-7282: Undefined Security Weakness

Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System OTRS before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain 1 list and 2...

PT-2011-1274

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.2.7 Description The issue allows remote attackers to obtain potentially sensitive e-mail address information. This is achieved by reading the Bcc header field in e-mails sent by the system,...

CVE-2009-5057: Undefined Security Weakness

The S/MIME feature in Open Ticket Request System OTRS before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations,...

CVE-2010-4758: Undefined Security Weakness

installer.pl in Open Ticket Request System OTRS before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen...

CVE-2011-1433: Undefined Security Weakness

The 1 AgentInterface and 2 CustomerInterface components in Open Ticket Request System OTRS before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the UserLogin and UserPW fiel...

CVE-2008-7281: Exposure of Sensitive Information to an Unauthorized Actor

Open Ticket Request System OTRS before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field...

CVE-2010-4766: Improper Input Validation

The AgentTicketForward feature in Open Ticket Request System OTRS before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a...

CVE-2008-7277: Undefined Security Weakness

Open Ticket Request System OTRS before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets...

PT-2011-1316

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.4.4 Description The issue allows remote authenticated users to bypass intended access restrictions by visiting a ticket, leveraging single-digit substrings of the CustomerID value. This can b...

CVE-2008-7276: Undefined Security Weakness

Kernel/System/Web/Request.pm in Open Ticket Request System OTRS before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass intended access restrictions via standard filesystem operations, related to incorrect interpretation of 0700 as a decimal val...

CVE-2009-5055: Undefined Security Weakness

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

CVE-2009-5056: Improper Input Validation

Open Ticket Request System OTRS before 2.4.0-beta2 does not properly enforce the moveinto permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-ticket...

CVE-2010-4763: Undefined Security Weakness

The ACL-customer-status Ticket Type setting in Open Ticket Request System OTRS before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the 1 Status, 2 Service, and 3 Queue via selections...

PT-2011-1713

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 2.4.9 and earlier Open Ticket Request System OTRS versions 3.x before 3.0.3 Description The issue concerns the handling of incoming encrypted e-mail messages based on revoked PGP or GPG keys. It does no...

PT-2011-1708

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta7 Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon hang, by performing a fulltext search. This is due to the improper...