Otrs vulnerabilities, page 5
159 vulnerabilities
Known vulnerabilities in Otrs products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 15 products.
CVE-2022-39052ubuntuznuny+3
EPSS score0.73%
An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the systemCVE-2022-39051ubuntuznuny+3EPSS score0.81%
Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party packageCVE-2022-32739ubuntuotrs2+4EPSS score0.91%
When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number.CVE-2022-32741ubuntuotrs2+2EPSS score0.86%
Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.CVE-2022-32740ubuntuotrs2+2EPSS score0.89%
A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances.CVE-2022-3501accessing template content without permissionsotrs+2EPSS score0.54%
Article template contents with sensitive data could be accessed from agents without permissions.CVE-2012-2582debianotrs2+2EPSS score4.20%
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.CVE-2012-4751debianotrs2+1EPSS score5.79%
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element.CVE-2012-4600debianotrs2+3EPSS score6.35%
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with nested HTML tags.CVE-2011-2385otrsiphonehandleEPSS score1.74%
The iPhoneHandle package 0.9.x before 0.9.7 and 1.0.x before 1.0.3 in Open Ticket Request System (OTRS) does not properly restrict use of the iPhoneHandle interface, which allows remote authenticated users to gain privileges, and consequently read or modify OTRS core objects, via unspecified vectors.CVE-2011-2746debianotrs2+1EPSS score1.74%
Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors.CVE-2011-1518debianotrs2+1EPSS score2.27%
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2011-1433debianotrs2+1EPSS score1.47%
The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the _UserLogin and _UserPW fields.CVE-2011-0456debianotrs2+1EPSS score3.00%
webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."CVE-2010-2080debianotrs2+1EPSS score1.50%
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.CVE-2010-0438debianotrs2+1EPSS score1.97%
Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.CVE-2010-4758debianotrs2+1EPSS score0.38%
installer.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen.CVE-2010-4763debianotrs2+1EPSS score1.57%
The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the (1) Status, (2) Service, and (3) Queue via selections.CVE-2010-4760debianotrs2+1EPSS score1.17%
Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote authenticated users to obtain potentially sensitive information by reading a ticket.CVE-2010-4766debianotrs2+1EPSS score1.09%
The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a standard e-mail client.