Otrs AG vulnerabilities
81 CVEs and advisories name Otrs AG as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-38058Tickets can be moved without permissions
- CVE-2023-38057XSS stored in survey answers
- CVE-2023-38056Code execution via System Configuration
- CVE-2023-2534Information disclouse and DoS via websocket push events
- CVE-2023-1250Code execution through ACL creation
- CVE-2023-1248 Possible XSS in Ticket Actions
- CVE-2022-4427SQL Injection via OTRS Search API
- CVE-2022-39052DoS attack using email
- CVE-2022-39051Perl Code execution in Template Toolkit
- CVE-2022-39050Possible XSS stored in customer information
- CVE-2022-39049Possible XSS in Admin Interface
- CVE-2022-32741Information disclosure in Request New Password feature
- CVE-2022-32740Information disclosure in the External Interface
- CVE-2022-32739OTRS version number is always in the exported ICS files
- CVE-2022-1004Information disclosure in the External Interface
- CVE-2022-0475Possible XSS attack via translation
- CVE-2021-36100Authenticated remote code execution
- CVE-2022-0474Disclosure of mail addresses
- CVE-2022-0473Dynamic field error message is vulnerable to XSS
- CVE-2021-36097Agents are able to lock the ticket without the "Owner" permission
- CVE-2021-36096Support Bundle includes S/Mime and PGP secret or PIN
- CVE-2021-36095User enumeration issue using "lost password" feature
- CVE-2021-36094XSS attack in appointment edit popup screen
- CVE-2021-36093DoS attack using PostMaster filters
- CVE-2021-36092XSS attack using special link in email
- CVE-2021-36091Unautorized access to the calendar appointments
- CVE-2021-21443Unautorized listing of the customer user emails
- CVE-2021-21442XSS vulnerability in Time Accounting
- CVE-2021-21440Support Bundle includes S/Mime and PGP keys
- CVE-2021-21441XSS in the ticket overview screens