OT
Product
Otrs
143
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 24Medium 68Low 2
Watch
Add Otrs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-1695 | – | Mar 1 | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject… Affected: 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; +34 more |
| CVE-2014-1694 | – | Feb 4 | Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm… Affected: 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +34 more |
| CVE-2014-1471 | – | Feb 4 | SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x… Affected: 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; +34 more |
| CVE-2012-4751 | – | Oct 22 | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers… Affected: 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +34 more |
| CVE-2012-4600 | – | Aug 31 | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is… Affected: 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +34 more |
| CVE-2012-2582 | – | Aug 23 | Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM… Affected: 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +34 more |
| CVE-2011-2746 | – | Aug 29 | Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +34 more |
| CVE-2011-2385 | – | Jul 19 | The iPhoneHandle package 0.9.x before 0.9.7 and 1.0.x before 1.0.3 in Open Ticket Request System (OTRS) does not properly restrict use of the iPhoneHandle interface, which allows… Affected: All versions, or not specified |
| CVE-2011-1518 | – | Apr 18 | Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web… Affected: 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +22 more |
| CVE-2010-4759 | – | Mar 18 | Open Ticket Request System (OTRS) before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to… Affected: through 3.0.0; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2010-4758 | – | Mar 18 | installer.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element,… Affected: through 3.0.2; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2009-5057 | – | Mar 18 | The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for… Affected: through 2.3.3; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2009-5056 | – | Mar 18 | Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass… Affected: through 2.4.0; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2009-5055 | – | Mar 18 | Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to… Affected: through 2.4.3; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2008-7283 | – | Mar 18 | Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform… Affected: through 2.2.5; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2008-7282 | – | Mar 18 | Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options… Affected: through 2.2.5; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2008-7281 | – | Mar 18 | Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain… Affected: through 2.2.6; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2008-7280 | – | Mar 18 | Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters,… Affected: through 2.2.6; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2008-7279 | – | Mar 18 | The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of… Affected: through 2.2.7; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2008-7278 | – | Mar 18 | The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL,… Affected: through 2.2.4; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2008-7277 | – | Mar 18 | Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which… Affected: through 2.3.0; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2008-7276 | – | Mar 18 | Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass… Affected: through 2.3.1; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2008-7275 | – | Mar 18 | Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) before 2.3.3 allow remote attackers to inject arbitrary web script or HTML via vectors… Affected: through 2.3.2; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2010-4767 | – | Mar 18 | Open Ticket Request System (OTRS) before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an… Affected: through 2.3.5; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2010-4763 | – | Mar 18 | The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote… Affected: through 2.4.10; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2010-4764 | – | Mar 18 | Open Ticket Request System (OTRS) before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages that were based on revoked PGP or GPG… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2010-4765 | – | Mar 18 | Race condition in the Kernel::System::Main::FileWrite method in Open Ticket Request System (OTRS) before 2.4.8 allows remote authenticated users to corrupt the TicketCounter.log… Affected: through 2.4.7; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2010-4766 | – | Mar 18 | The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to… Affected: through 2.4.6; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2010-4762 | – | Mar 18 | Cross-site scripting (XSS) vulnerability in the rich-text-editor component in Open Ticket Request System (OTRS) before 3.0.0-beta2 allows remote authenticated users to inject… Affected: through 3.0.0; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2010-4761 | – | Mar 18 | The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote… Affected: through 3.0.0; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2010-4768 | – | Mar 18 | Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions… Affected: through 2.3.4; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2011-1433 | – | Mar 18 | The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database,… Affected: through 3.0.5; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2010-4760 | – | Mar 18 | Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote… Affected: through 3.0.0; 0.5; 0.5; 0.5; 0.5; 0.5; +34 more |
| CVE-2011-0456 | – | Mar 11 | webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection… Affected: through 2.3.4; 1.3.2; 1.3.3; 2.0.1; 2.0.2; 2.0.3; +23 more |
| CVE-2010-4071 | – | Jan 20 | Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML… Affected: 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; 2.4.6; +2 more |
| CVE-2010-3476 | – | Sep 20 | Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which… Affected: 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5; 2.4.1; +6 more |
| CVE-2010-2080 | – | Sep 20 | Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject… Affected: 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5; 2.4.1; +6 more |
| CVE-2010-0438 | – | Feb 9 | Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and… Affected: 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; 2.1.6; +20 more |
| CVE-2008-1515 | – | Apr 1 | The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to "read and modify objects" via SOAP requests, related to "Missing security checks." Affected: 2.1.0 before 2.1.8; 2.2.0 before 2.2.6 |
| CVE-2007-2524 | – | May 8 | Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction… Affected: 2.0.4 |
| CVE-2005-3893 | – | Nov 29 | Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL… Affected: 1.0.0; 1.3.2; 2.0.0; 2.0.1; 2.0.2; 2.0.3 |
| CVE-2005-3895 | – | Nov 29 | Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the… Affected: 1.0.0; 1.3.2; 2.0.0; 2.0.1; 2.0.2; 2.0.3 |
| CVE-2005-3894 | – | Nov 29 | Multiple cross-site scripting (XSS) vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users… Affected: 1.0.0; 1.3.2; 2.0.0; 2.0.1; 2.0.2; 2.0.3 |