Page 8 of 44 results (0.007 seconds)

CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0

CVE-2019-10067

https://notcve.org/view.php?id=CVE-2019-10067

An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS. Se encontró un problema en Open Ticket Request System (OTRS) versión 7.x hasta 7.0.6 y en Community Edition versión versión 5.0.x hasta 5.0.35 y versión 6.0.x hasta 6.0.17. Un atacante logeado en OTRS como un agente de usuario con los permisos apropiados puede manipular la URL para provocar la ejecución de JavaScript en el contexto de OTRS. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html https://community.otrs.com/security-advisory-2019-05-security-update-for-otrs-framework • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2019-9751

https://notcve.org/view.php?id=CVE-2019-9751

An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5. An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. This is related to Kernel/Output/Template/Document.pm. Se ha descubierto un problema en Open Ticket Request System (OTRS), en CVErsiones 6.x, anteriores a la 6.0.17 y CVErsiones 7.x anteriores a la 7.0.5. Un atacante que haya iniciado sesión en OTRS como usuario administrador podría manipular la URL para provocar la ejecución de JavaScript en el contexto de OTRS. • https://community.otrs.com/security-advisory-2019-02-security-update-for-otrs-framework • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0

CVE-2019-9752

https://notcve.org/view.php?id=CVE-2019-9752

An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm. Se ha descubierto un problema en Open Ticket Request System (OTRS), en CVErsiones 5.x anteriores a la 5.0.34, CVErsiones 6.x anteriores a la 6.0.16 y CVErsiones 7.x anteriores a la 7.0.4. Un atacante que haya iniciado sesión en OTRS como usuario agente o cliente podría subir un recurso manipulado para provocar la ejecución de JavaScript en el contexto de OTRS. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html https://community.otrs.com/security-advisory-2019-01-security-update-for-otrs-framework https://lists.debian.org/debian-lts-announce/2019/03/msg00023.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0

CVE-2018-20800

https://notcve.org/view.php?id=CVE-2018-20800

An issue was discovered in Open Ticket Request System (OTRS) 5.0.31 and 6.0.13. Users updating to 6.0.13 (also patchlevel updates) or 5.0.31 (only major updates) will experience data loss in their agent preferences table. Se ha descubierto un problema en Open Ticket Request System (OTRS), en sus CVErsiones 5.0.31 y 6.0.13. Los usuarios que actualicen a la CVErsión 6.0.13 (también actualizaciones a niCVEl de parche) o 5.0.31 (solo actualizaciones principales) experimentarán una pérdida de datos en su tabla de preferencias de agente. • https://community.otrs.com/security-advisory-2018-10-security-update-for-otrs-framework • CWE-20: Improper Input Validation •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-10198

https://notcve.org/view.php?id=CVE-2018-10198

An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets. Se ha descubierto un problema en OTRS, en versiones 6.0.x anteriores a la 6.0.7. Un atacante que haya iniciado sesión en OTRS como cliente puede emplear la pantalla de visualización de tickets para revelar información interna de artículos de sus tickets de cliente. • https://community.otrs.com/security-advisory-2018-01-security-update-for-otrs-framework • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •