CVSS: 4.3EPSS: 0%CPEs: 65EXPL: 2CVE-2012-2582 – OTRS Open Technology Real Services 3.1.4 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2582
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Open Ticket Request System (OTRS) Help Desk v2.4.x anterior a v2.4.13, v3.0.x anterior a v3.0.15, y v3.1.x anterior a v3.1.9, y OTRS ITSM v2.1.x anterior a v2.1.5, v3.0.x anterior a v3.0.6, y v3.1.x anterior a v3.1.6, permite a atacantes remotos inyectar código web o HTML arbitrario a través del cuerpo de un mensaje de correo electrónico con (1)una propiedad de una expresión en un atributo STYLE de un elemento arbitrario o (2) texto UTF-7 en un elemento META HTTP-EQUIV="CONTENT-TYPE". • https://www.exploit-db.com/exploits/20359 http://lists.opensuse.org/opensuse-updates/2012-09/msg00024.html http://secunia.com/advisories/50513 http://www.debian.org/security/2012/dsa-2536 http://www.kb.cert.org/vuls/id/582879 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 79EXPL: 0CVE-2011-2746
https://notcve.org/view.php?id=CVE-2011-2746
Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors. Vulnerabilidad no especificada en Kernel/Modules/AdminPackageManager.pm en OTRS-Core en Open Ticket Request System (OTRS) v2.x antes de v2.4.11 y v3.x antes de v3.0.10. permite a administradores autenticados remotamente leer archivos de su elección a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-updates/2011-09/msg00011.html http://otrs.org/advisory/OSA-2011-03-en http://secunia.com/advisories/45701 http://secunia.com/advisories/45894 http://www.osvdb.org/74602 http://www.securityfocus.com/bid/49251 •
CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2011-1518
https://notcve.org/view.php?id=CVE-2011-1518
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Open Ticket Request System (OTRS) v2.4.x anterior a v2.4.10 y 3.x anterior a v3.0.7 permite a atacantes remotos inyectar script web de su elección o HTML a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://otrs.org/advisory/OSA-2011-01-en http://secunia.com/advisories/44029 http://secunia.com/advisories/44479 http://www.debian.org/security/2011/dsa-2231 http://www.osvdb.org/71790 http://www.securityfocus.com/bid/47323 http://www.vupen.com/english/advisories/2011/1186 https://exchange.xforce.ibmcloud.com/vulnerabilities/66698 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 110EXPL: 0CVE-2011-1433
https://notcve.org/view.php?id=CVE-2011-1433
The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the _UserLogin and _UserPW fields. Los componentes (1) AgentInterface y (2) CustomerInterface en Open Ticket Request System (OTRS) anterior a v3.0.6 coloca las credenciales sin cifrar en los datos de sesión en la base de datos, lo que hace que sea más fácil para los atacantes dependientes de contexto obtener información sensible mediante la lectura de los campos _UserLogin y _UserPW. • http://bugs.otrs.org/show_bug.cgi?id=6878 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 https://exchange.xforce.ibmcloud.com/vulnerabilities/66196 • CWE-310: Cryptographic Issues •
CVSS: 1.9EPSS: 0%CPEs: 107EXPL: 1CVE-2010-4758
https://notcve.org/view.php?id=CVE-2010-4758
installer.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen. installer.pl en Open Ticket Request System (OTRS) anterior a v3.0.3 tiene un campo Inbound Mail Password que utiliza texto claro, en lugar de el tipo password, por su elemento INPUT, lo que hace que sea más fácil para los atacantes físicamente próximos a obtener la contraseña mediante la lectura de la pantalla del equipo. • http://bugs.otrs.org/show_bug.cgi?id=6302 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-310: Cryptographic Issues •