PT-2011-1712

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta1 Description The issue concerns the ACL-customer-status Ticket Type setting, which fails to restrict ticket options after an AJAX reload. This allows remote authenticated users to...

PT-2011-1709

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta6 Description The issue allows remote authenticated users to obtain potentially sensitive information by reading a ticket, due to the addition of email-notification-ext articles to...

PT-2011-1710

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.0-beta3 Description The issue concerns the customer-interface ticket-print dialog, which fails to properly restrict customer-visible data. This allows remote authenticated users to obtain...

PT-2011-1707

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.0.3 Description The issue concerns the installer.pl in Open Ticket Request System OTRS, where the Inbound Mail Password field uses the text type instead of the password type for its INPUT...

PT-2011-1268

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.3.3 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The attack vectors a...

PT-2011-1271

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.2.5 Open Ticket Request System OTRS versions 2.3.x prior to 2.3.0-beta1 Description The issue is related to the S/MIME feature in OTRS, which does not properly configure the RANDFILE...

CVE-2010-4764: Undefined Security Weakness

Open Ticket Request System OTRS before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages that were based on revoked PGP or GPG keys, which makes it easier for remote attackers to spoof e-mail communication by leveraging a key that has a revocation...

CVE-2008-7278: Improper Input Validation

The S/MIME feature in Open Ticket Request System OTRS before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available fo...

CVE-2010-4768: Undefined Security Weakness

Open Ticket Request System OTRS before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remov...

CVE-2010-4761: Undefined Security Weakness

The customer-interface ticket-print dialog in Open Ticket Request System OTRS before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the 1 responsible, 2 owner, 3 accounted time, 4 pending until...

CVE-2010-4762: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the rich-text-editor component in Open Ticket Request System OTRS before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface...

PT-2011-1714

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.4.8 Description A race condition exists in the Kernel::System::Main::FileWrite method, allowing remote authenticated users to corrupt the TicketCounter.log data in certain circumstances by...

CVE-2008-7275: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open Ticket Request System OTRS before 2.3.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 AgentTicketMailbox or 2 CustomerTicketOverView...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

DEBIAN-CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

CVE-2011-0456: Improper Neutralization of Special Elements used in an OS Command

webscript.pl in Open Ticket Request System OTRS 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."...

PT-2011-2359

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 2.3.4 and earlier Description The issue allows remote attackers to execute arbitrary commands via unspecified vectors, related to a command injection vulnerability. Recommendations For OTRS versions 2.3...