CVSS: 4.0EPSS: 0%CPEs: 100EXPL: 0CVE-2010-4761
https://notcve.org/view.php?id=CVE-2010-4761
The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the (1) responsible, (2) owner, (3) accounted time, (4) pending until, and (5) lock fields by reading this dialog. El cuadro de diálogo de interfaz de cliente de impresión de tickets en Open Ticket Request System (OTRS) anterior a v3.0.0-beta3 no restringe de forma correcta los datos visibles del cliente, lo que permite a usuarios remotos autenticados obtener información sensible de los campos (1) responsible, (2) owner, (3) accounted time, (4) pending until, y (5) lock mediante la lectura de este cuadro de diálogo. • http://bugs.otrs.org/show_bug.cgi?id=5875 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.9EPSS: 0%CPEs: 95EXPL: 0CVE-2010-4765
https://notcve.org/view.php?id=CVE-2010-4765
Race condition in the Kernel::System::Main::FileWrite method in Open Ticket Request System (OTRS) before 2.4.8 allows remote authenticated users to corrupt the TicketCounter.log data in opportunistic circumstances by creating tickets. Condición de carrera en el método Kernel::System::Main::FileWrite en Open Ticket Request System (OTRS) anterior a v2.4.8 permite a usuarios remotos autenticados corromper los datos en TicketCounter.log en circunstancias oportunistas mediante la creación de tickets. • http://bugs.otrs.org/show_bug.cgi?id=4936 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 3.5EPSS: 0%CPEs: 103EXPL: 0CVE-2010-4760
https://notcve.org/view.php?id=CVE-2010-4760
Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote authenticated users to obtain potentially sensitive information by reading a ticket. Open Ticket Request System (OTRS) anteriores a v3.0.0-beta6 adiciona los email-notification-ext a los tickets durante el procesamiento de las notificaciones basadas en eventos, que permite a usuarios remotos autenticados para obtener información sensible mediante la lectura de un ticket. • http://bugs.otrs.org/show_bug.cgi?id=5975 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.6EPSS: 0%CPEs: 8EXPL: 0CVE-2010-4071
https://notcve.org/view.php?id=CVE-2010-4071
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en AgentTicketZoom para OTRS v2.4.x v2.4.9, cuando RichText está activada, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de JavaScript en un correo electrónico HTML. • http://bugs.gentoo.org/342687 http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html http://otrs.org/advisory/OSA-2010-03-en http://secunia.com/advisories/41978 http://www.osvdb.org/68882 http://www.vuxml.org/freebsd/96e776c7-e75c-11df-8f26-00151735203a.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 2%CPEs: 12EXPL: 0CVE-2010-3476
https://notcve.org/view.php?id=CVE-2010-3476
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080. Open Ticket Request System (OTRS) v2.3.x anteriores a v2.3.6 y v2.4.x anteriores a v2.4.8 no controla correctamente la adecuación de las expresiones regulares de Perl contra los mensajes de correo electrónico HTML, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de CPU) a través de un mensaje grande, es una vulnerabilidad distinta a CVE-2010-2080. • http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html http://otrs.org/advisory/OSA-2010-02-en http://secunia.com/advisories/41381 http://security-tracker.debian.org/tracker/CVE-2010-2080 http://www.securityfocus.com/bid/43264 https://exchange.xforce.ibmcloud.com/vulnerabilities/61869 • CWE-20: Improper Input Validation •