10 results · Clear filters · Feed
-
High 8.6
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQ…
-
High 8.7
Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnera…
-
High 7.5
An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-m…
-
High 7.5
Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email. Parsing the content of email…
-
High 8.2
Passwords are written to Admin Log Module
Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled. This issue affects: * OTRS from 7.0.…
-
High 7.1
An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the exe…
-
High 8.8
An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able…
-
High 8.7
SSL Certificates are not checked for E-Mail Handling
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the …
-
High 7.2
Code execution via System Configuration
Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X b…
-
High 7.5
DoS attack using email
An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system