CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 08/05/2023 |
| CVE-2018-17883 | 보통6.1 | An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS. | 16/04/2023 |
| CVE-2023-1250 | 높음7.8 | Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names
This issue affects OTRS: from 7.0.X before 7.0.4 | 20/03/2023 |
| CVE-2023-1248 | 보통6.1 | Improper Input Validation vulnerability in OTRS AG OTRS (Ticket Actions modules), OTRS AG ((OTRS)) Community Edition (Ticket Actions modules) allows Cross-Site Scripting (XSS).This issue affects OTRS: from 7.0.X before 7.0.42; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
| 20/03/2023 |
| CVE-2022-4427 | 심각9.8 | Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice
This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34. | 19/12/2022 |
| CVE-2022-3501 | 높음7.5 | Article template contents with sensitive data could be accessed from agents without permissions. | 17/10/2022 |
| CVE-2022-39052 | 보통6.5 | An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system | 17/10/2022 |
| CVE-2022-39051 | 높음8.8 | Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package | 05/09/2022 |
| CVE-2022-39050 | 보통4.8 | An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external data sources e.g. databa | 05/09/2022 |
| CVE-2022-39049 | 보통4.8 | An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. | 05/09/2022 |
| CVE-2022-32741 | 보통5.3 | Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time. | 13/06/2022 |
| CVE-2022-32740 | 보통5.3 | A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances. | 13/06/2022 |
| CVE-2022-32739 | 보통5.3 | When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number. | 13/06/2022 |
| CVE-2022-1004 | 보통4.3 | Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled. | 21/03/2022 |
| CVE-2022-0475 | 보통5.4 | Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.32 and prior versions, 8.0.x version: 8.0.19 and prior versions. | 21/03/2022 |
| CVE-2021-36100 | 높음8.8 | Specially crafted string in OTRS system configuration can allow the execution of any system command. | 21/03/2022 |
| CVE-2022-0474 | 낮음3.5 | Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions. | 07/02/2022 |
| CVE-2022-0473 | 보통4.8 | OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions. | 07/02/2022 |