CVSS: 5.0EPSS: 0%CPEs: 68EXPL: 0CVE-2008-7280
https://notcve.org/view.php?id=CVE-2008-7280
Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted message. Kernel/System/EmailParser.pm en PostmasterPOP3.pl en Open Ticket Request System (OTRS) anterior a v2.2.7 no controla correctamente los mensajes de correo electrónico con caracteres UTF-8 incorrectos, lo que permite a atacantes remotos provocar una denegación de servicio (corte de recuperación de correo electrónico) a través de un mensaje manipulado. • http://bugs.otrs.org/show_bug.cgi?id=2934 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 68EXPL: 0CVE-2008-7281
https://notcve.org/view.php?id=CVE-2008-7281
Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field. Open Ticket Request System (OTRS) anteriores a v2.2.7 envía correos electrónicos que contienen un campo cabecera Bcc que lista los destinatarios de la BCC (copia carbón blindada) lo que permite a atacantes remotos obtener direcciones de correo sensibles leyendo este campo. • http://bugs.otrs.org/show_bug.cgi?id=1882 http://bugs.otrs.org/show_bug.cgi?id=2814 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.6EPSS: 0%CPEs: 67EXPL: 0CVE-2008-7282
https://notcve.org/view.php?id=CVE-2008-7282
Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain (1) list and (2) write operations on queues, via unspecified vectors. Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm en Open Ticket Request System (OTRS) anteriores a v2.2.6, cuando las opciones CustomerPanelOwnSelection y CustomerGroupSupport están habilitados, permite a usuarios remotos autenticados eludir las restricciones de acceso previsto, y llevar a cabo determinadas operaciones (1) list y (2) write en las colas, a través de vectores no especificados. • http://bugs.otrs.org/show_bug.cgi?id=2696 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.0EPSS: 0%CPEs: 67EXPL: 0CVE-2008-7283
https://notcve.org/view.php?id=CVE-2008-7283
Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions. Open Ticket Request System (OTRS) anteriores a v2.2.6, cuando el grupo de atención al cliente está habilitada, permite a usuarios remotos autenticados eludir restricciones de acceso y realizar actualizaciones de la interfaz web a los tickets mediante el aprovechamiento de la cola de los permisos de lectura. • http://bugs.otrs.org/show_bug.cgi?id=2544 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 91EXPL: 1CVE-2009-5055
https://notcve.org/view.php?id=CVE-2009-5055
Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the CustomerID 12 account to read tickets that should be available only to CustomerID 1 or CustomerID 2. Open Ticket Request System (OTRS) anteriores a v2.4.4 permite el acceso a las subcadenas básicas de un dígito simple del valor CustomerID, que permite a usuarios remotos autenticados eludir las restricciones de acceso previsto en circunstancias oportunistas visualizando un ticket, como se demuestra mediante el aprovechamiento de la cuenta CustomerID 12 para leer tickets que deben estar disponibles sólo para los CustomerID 1 o 2. • http://bugs.otrs.org/show_bug.cgi?id=4105 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 • CWE-264: Permissions, Privileges, and Access Controls •