Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later… Read More »CVE-2021-36091 | ((OTRS)) Community Edition,OTRS
Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x… Read More »CVE-2021-21443 | ((OTRS)) Community Edition,OTRS
There is a XSS vulnerability in the ticket overview screens. It’s possible to collect various information by having an e-mail shown in the overview screen.… Read More »CVE-2021-21441 | ((OTRS)) Community Edition,OTRS
Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version… Read More »CVE-2021-21440 | ((OTRS)) Community Edition,OTRS
DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause… Read More »CVE-2021-21439 | ((OTRS)) Community Edition,OTRS
When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used… Read More »CVE-2020-1776 | ((OTRS)) Community Edition,OTRS
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it’s possible to mix them and to… Read More »CVE-2020-1774 | ((OTRS)) Community Edition,OTRS
An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be… Read More »CVE-2020-1773 | ((OTRS)) Community Edition,OTRS
It’s possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already… Read More »CVE-2020-1772 | ((OTRS)) Community Edition,OTRS
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code… Read More »CVE-2020-1771 | ((OTRS)) Community Edition,OTRS
Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions,… Read More »CVE-2020-1770 | ((OTRS)) Community Edition,OTRS
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects:… Read More »CVE-2020-1769 | ((OTRS)) Community Edition,OTRS
Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send… Read More »CVE-2020-1767 | ((OTRS)) Community Edition,OTRS
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript… Read More »CVE-2020-1766 | ((OTRS)) Community Edition,OTRS
An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS))… Read More »CVE-2020-1765 | ((OTRS)) Community Edition,OTRS