# CVEs published 2011-03-18 25 CVEs were published on March 18, 2011: 0 critical, 0 high. Days are UTC. - [CVE-2008-7275](https://cve.now/CVE-2008-7275.md): Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) before 2.3.3 allow remote attackers to inject arbit (no CVSS) - [CVE-2008-7276](https://cve.now/CVE-2008-7276.md): Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which (no CVSS) - [CVE-2008-7277](https://cve.now/CVE-2008-7277.md): Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during author (no CVSS) - [CVE-2008-7278](https://cve.now/CVE-2008-7278.md): The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE (no CVSS) - [CVE-2008-7279](https://cve.now/CVE-2008-7279.md): The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended acces (no CVSS) - [CVE-2008-7280](https://cve.now/CVE-2008-7280.md): Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages (no CVSS) - [CVE-2008-7281](https://cve.now/CVE-2008-7281.md): Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which (no CVSS) - [CVE-2008-7282](https://cve.now/CVE-2008-7282.md): Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSel (no CVSS) - [CVE-2008-7283](https://cve.now/CVE-2008-7283.md): Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended (no CVSS) - [CVE-2009-5055](https://cve.now/CVE-2009-5055.md): Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which a (no CVSS) - [CVE-2009-5056](https://cve.now/CVE-2009-5056.md): Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move\_into permission setting for a queue, which allows re (no CVSS) - [CVE-2009-5057](https://cve.now/CVE-2009-5057.md): The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the RANDFILE and HOME environment variables for Open (no CVSS) - [CVE-2010-4758](https://cve.now/CVE-2010-4758.md): installer.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the pa (no CVSS) - [CVE-2010-4759](https://cve.now/CVE-2010-4759.md): Open Ticket Request System (OTRS) before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which (no CVSS) - [CVE-2010-4760](https://cve.now/CVE-2010-4760.md): Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifi (no CVSS) - [CVE-2010-4761](https://cve.now/CVE-2010-4761.md): The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visib (no CVSS) - [CVE-2010-4762](https://cve.now/CVE-2010-4762.md): Cross-site scripting (XSS) vulnerability in the rich-text-editor component in Open Ticket Request System (OTRS) before 3.0.0-beta2 allows re (no CVSS) - [CVE-2010-4763](https://cve.now/CVE-2010-4763.md): The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options aft (no CVSS) - [CVE-2010-4764](https://cve.now/CVE-2010-4764.md): Open Ticket Request System (OTRS) before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages th (no CVSS) - [CVE-2010-4765](https://cve.now/CVE-2010-4765.md): Race condition in the Kernel::System::Main::FileWrite method in Open Ticket Request System (OTRS) before 2.4.8 allows remote authenticated u (no CVSS) - [CVE-2010-4766](https://cve.now/CVE-2010-4766.md): The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail mes (no CVSS) - [CVE-2010-4767](https://cve.now/CVE-2010-4767.md): Open Ticket Request System (OTRS) before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters ass (no CVSS) - [CVE-2010-4768](https://cve.now/CVE-2010-4768.md): Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypa (no CVSS) - [CVE-2011-1433](https://cve.now/CVE-2011-1433.md): The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials in (no CVSS) - [CVE-2011-1148](https://cve.now/CVE-2011-1148.md): Use-after-free vulnerability in the substr\_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2011-03-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.