CVSS: 3.5EPSS: 0%CPEs: 12EXPL: 0CVE-2010-2080
https://notcve.org/view.php?id=CVE-2010-2080
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Open Ticket Request System (OTRS) v2.3.x anteriores a v2.3.6 y v2.4.x anteriores a v2.4.8, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no específicos. • http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html http://otrs.org/advisory/OSA-2010-02-en http://secunia.com/advisories/41381 http://security-tracker.debian.org/tracker/CVE-2010-2080 http://www.securityfocus.com/bid/43264 https://exchange.xforce.ibmcloud.com/vulnerabilities/61868 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 26EXPL: 0CVE-2010-0438
https://notcve.org/view.php?id=CVE-2010-0438
Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Múltiples vulnerabilidades de inyección SQL en Kernel/System/Ticket.pm en OTRS-Core en Open Ticket Request System (OTRS) v2.1.x anteriores a v2.1.9, v2.2.x anteriores a v2.2.9, v2.3.x anteriores a v2.3.5, y v2.4.x anteriores a v2.4.7 permite a usuarios autenticados ejecutar comandos SQL a través de vectores sin especificar. • http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html http://otrs.org/advisory/OSA-2010-01-en http://otrs.org/releases/2.4.7 http://secunia.com/advisories/38507 http://secunia.com/advisories/38544 http://source.otrs.org/viewvc.cgi/otrs/Kernel/System/Ticket.pm?view=log http://www.osvdb.org/62181 http://www.otrs.org/news/2010/otrs_2-4-7 http://www.securityfocus.com/bid/38146 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2008-1515
https://notcve.org/view.php?id=CVE-2008-1515
The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to "read and modify objects" via SOAP requests, related to "Missing security checks." La interfaz SOAP en OTRS versión 2.1.x anterior a 2.1.8 y versión 2.2.x anterior a 2.2.6, permite a los atacantes remotos “read and modify objects" por medio de peticiones SOAP, relacionadas con "Missing security checks" • http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html http://otrs.org/advisory/OSA-2008-01-en http://secunia.com/advisories/29585 http://secunia.com/advisories/29622 http://secunia.com/advisories/29859 http://www.securityfocus.com/bid/28647 https://exchange.xforce.ibmcloud.com/vulnerabilities/41577 https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00284.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 3CVE-2007-2524 – OTRS 2.0.4 - index.pl Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-2524
Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841. Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo index.pl en Open Ticket Request System (OTRS) versión 2.0.x, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro Subaction en una acción AgentTicketMailbox. NOTA: DEBIAN: DSA-1299 originalmente usó este identificador para un problema de ipsec-tools, pero el identificador adecuado para el problema de ipsec-tools es CVE-2007-1841. • https://www.exploit-db.com/exploits/29962 http://osvdb.org/35821 http://osvdb.org/35822 http://secunia.com/advisories/25205 http://secunia.com/advisories/25419 http://secunia.com/advisories/25787 http://securityreason.com/securityalert/2668 http://www.debian.org/security/2007/dsa-1298 http://www.novell.com/linux/security/advisories/2007_13_sr.html http://www.securityfocus.com/archive/1/467870/100/0/threaded http://www.securityfocus.com/archive/1/471192/100/0/thre • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 3CVE-2005-3894 – OTRS 2.0 - 'index.pl' Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2005-3894
Multiple cross-site scripting (XSS) vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) hex-encoded values in the QueueID parameter and (2) Action parameters. • https://www.exploit-db.com/exploits/26552 http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/039001.html http://marc.info/?l=bugtraq&m=113272360804853&w=2 http://moritz-naumann.com/adv/0007/otrsmulti/0007.txt http://otrs.org/advisory/OSA-2005-01-en http://secunia.com/advisories/17685 http://secunia.com/advisories/18101 http://secunia.com/advisories/18887 http://securitytracker.com/id?1015262 http://www.debian.org/security/2006/dsa-973 http://www. •