CVSS: 4.0EPSS: 0%CPEs: 104EXPL: 0CVE-2010-4759
https://notcve.org/view.php?id=CVE-2010-4759
Open Ticket Request System (OTRS) before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to cause a denial of service (daemon hang) via a fulltext search. Open Ticket Request System (OTRS) anteriores a v3.0.0-beta7 no restringen correctamente la fecha de los tickets que se encuentran dentro del ámbito de una búsqueda, lo que permite a usuarios remotos autenticados causar una denegación de servicio (cuelgue del demonio) a través de una búsqueda de texto completo. • http://bugs.otrs.org/show_bug.cgi?id=1639 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 98EXPL: 1CVE-2010-4763
https://notcve.org/view.php?id=CVE-2010-4763
The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the (1) Status, (2) Service, and (3) Queue via selections. La configuración ACL-customer-status Ticket Type en Open Ticket Request System (OTRS) anteriores a v3.0.0-beta1 no restringe las opciones del ticket después de una recarga de AJAX, lo que permite a usuarios remotos autenticados eludir las restricciones destinadas ACL en las selecciones (1) Status, (2) Service, y (3) Qeue. • http://bugs.otrs.org/show_bug.cgi?id=4399 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 100EXPL: 0CVE-2010-4761
https://notcve.org/view.php?id=CVE-2010-4761
The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the (1) responsible, (2) owner, (3) accounted time, (4) pending until, and (5) lock fields by reading this dialog. El cuadro de diálogo de interfaz de cliente de impresión de tickets en Open Ticket Request System (OTRS) anterior a v3.0.0-beta3 no restringe de forma correcta los datos visibles del cliente, lo que permite a usuarios remotos autenticados obtener información sensible de los campos (1) responsible, (2) owner, (3) accounted time, (4) pending until, y (5) lock mediante la lectura de este cuadro de diálogo. • http://bugs.otrs.org/show_bug.cgi?id=5875 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.9EPSS: 0%CPEs: 95EXPL: 0CVE-2010-4765
https://notcve.org/view.php?id=CVE-2010-4765
Race condition in the Kernel::System::Main::FileWrite method in Open Ticket Request System (OTRS) before 2.4.8 allows remote authenticated users to corrupt the TicketCounter.log data in opportunistic circumstances by creating tickets. Condición de carrera en el método Kernel::System::Main::FileWrite en Open Ticket Request System (OTRS) anterior a v2.4.8 permite a usuarios remotos autenticados corromper los datos en TicketCounter.log en circunstancias oportunistas mediante la creación de tickets. • http://bugs.otrs.org/show_bug.cgi?id=4936 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 3.5EPSS: 0%CPEs: 91EXPL: 1CVE-2009-5055
https://notcve.org/view.php?id=CVE-2009-5055
Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the CustomerID 12 account to read tickets that should be available only to CustomerID 1 or CustomerID 2. Open Ticket Request System (OTRS) anteriores a v2.4.4 permite el acceso a las subcadenas básicas de un dígito simple del valor CustomerID, que permite a usuarios remotos autenticados eludir las restricciones de acceso previsto en circunstancias oportunistas visualizando un ticket, como se demuestra mediante el aprovechamiento de la cuenta CustomerID 12 para leer tickets que deben estar disponibles sólo para los CustomerID 1 o 2. • http://bugs.otrs.org/show_bug.cgi?id=4105 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-264: Permissions, Privileges, and Access Controls •