CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2011-1518
https://notcve.org/view.php?id=CVE-2011-1518
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Open Ticket Request System (OTRS) v2.4.x anterior a v2.4.10 y 3.x anterior a v3.0.7 permite a atacantes remotos inyectar script web de su elección o HTML a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://otrs.org/advisory/OSA-2011-01-en http://secunia.com/advisories/44029 http://secunia.com/advisories/44479 http://www.debian.org/security/2011/dsa-2231 http://www.osvdb.org/71790 http://www.securityfocus.com/bid/47323 http://www.vupen.com/english/advisories/2011/1186 https://exchange.xforce.ibmcloud.com/vulnerabilities/66698 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 94EXPL: 1CVE-2010-4766
https://notcve.org/view.php?id=CVE-2010-4766
The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a standard e-mail client. La característica AgentTicketForward en Open Ticket Request System (OTRS) anteriores a v2.4.7 no elimina correctamente las imágenes incluidas en mensajes de correo electrónico HTML, lo que podría permitir a atacantes remotos obtener información sensible de la imagen en circunstancias oportunistas mediante la lectura de un mensaje enviado con un cliente de correo estándar. • http://bugs.otrs.org/show_bug.cgi?id=4818 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-20: Improper Input Validation •
CVSS: 2.1EPSS: 0%CPEs: 83EXPL: 1CVE-2009-5056
https://notcve.org/view.php?id=CVE-2009-5056
Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-tickets list. Open Ticket Request System (OTRS) anteriores a v2.4.0-beta2 no hace cumplir de forma correcta la configuración del permiso move_into para una cola, lo que permite a usuarios remotos autenticados eludir las restricciones de acceso previsto y leer un ticket viéndolo y seleccionándolo de la lista de tickets vistos. • http://bugs.otrs.org/show_bug.cgi?id=3583 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 78EXPL: 0CVE-2008-7275
https://notcve.org/view.php?id=CVE-2008-7275
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) before 2.3.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) AgentTicketMailbox or (2) CustomerTicketOverView. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Open Ticket Request System (OTRS) anteriores a v2.3.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores relacionados con (1) AgentTicketMailbox or (2) CustomerTicketOverView. • http://bugs.otrs.org/show_bug.cgi?id=3287 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 69EXPL: 0CVE-2008-7279
https://notcve.org/view.php?id=CVE-2008-7279
The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors. El componente CustomerInterface en Open Ticket Request System (OTRS) anterior a v2.2.8 permite a usuarios remotos autenticados eludir las restricciones de acceso impuestas y los tickets clientes arbitrarios a través de vectores no especificados. • http://bugs.otrs.org/show_bug.cgi?id=3103 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-264: Permissions, Privileges, and Access Controls •