50 results · Feed
-
Medium 6.3
Host header injection by attachments in web service
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType …
-
Medium 4.1
Tickets can be moved without permissions
An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the needed permission. This issue affects OTRS: from 8.0.X before 8.0.35.
-
Medium 4.1
XSS stored in survey answers
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as a…
-
High 7.2
Code execution via System Configuration
Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X b…
-
Low 3.5
Information exposure of template content due to missing check of permissions
Article template contents with sensitive data could be accessed from agents without permissions.
-
High 7.5
DoS attack using email
An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system
-
Medium 6.8
Perl Code execution in Template Toolkit
Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package
-
Low 3.5
Possible XSS in Admin Interface
An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS.
-
Medium 4.6
Possible XSS stored in customer information
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same iss…
-
Medium 6.4
Authenticated remote code execution
Specially crafted string in OTRS system configuration can allow the execution of any system command.