Otrs Archives - CVE Vulnerability

CVE-2008-7283

Sun, 26 Feb 2023 09:11:57 +0000

Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions.

The post CVE-2008-7283 appeared first on CVE Vulnerability.

CVE-2008-7282

Sun, 26 Feb 2023 09:11:57 +0000

Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain (1) list and (2) write operations on queues, via unspecified vectors.

The post CVE-2008-7282 appeared first on CVE Vulnerability.

CVE-2008-7281

Sun, 26 Feb 2023 09:11:57 +0000

Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field.

The post CVE-2008-7281 appeared first on CVE Vulnerability.

CVE-2008-7280

Sun, 26 Feb 2023 09:11:57 +0000

Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted message.

The post CVE-2008-7280 appeared first on CVE Vulnerability.

CVE-2008-7279

Sun, 26 Feb 2023 09:11:57 +0000

The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors.

The post CVE-2008-7279 appeared first on CVE Vulnerability.

CVE-2018-19143

Sun, 26 Feb 2023 06:48:03 +0000

Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching is mishandled.

The post CVE-2018-19143 appeared first on CVE Vulnerability.

CVE-2018-19142

Sun, 26 Feb 2023 06:48:03 +0000

Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL.

The post CVE-2018-19142 appeared first on CVE Vulnerability.

CVE-2018-19141

Sun, 26 Feb 2023 06:48:03 +0000

Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and customer preferences are mishandled.

The post CVE-2018-19141 appeared first on CVE Vulnerability.

CVE-2018-16586

Sun, 26 Feb 2023 06:47:07 +0000

In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources.

The post CVE-2018-16586 appeared first on CVE Vulnerability.

CVE-2018-16587

Sun, 26 Feb 2023 06:47:07 +0000

In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to.

The post CVE-2018-16587 appeared first on CVE Vulnerability.