Vulnerabilities > Otrs > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-09-05 | CVE-2022-39050 | Cross-site Scripting vulnerability in Otrs An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. | 4.8 |
| 2022-06-13 | CVE-2022-32739 | Unspecified vulnerability in Otrs Calendar Resource Planning and Otrs When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number. | 5.3 |
| 2022-06-13 | CVE-2022-32740 | Unspecified vulnerability in Otrs A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances. | 5.3 |
| 2022-06-13 | CVE-2022-32741 | Unspecified vulnerability in Otrs Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time. | 5.3 |
| 2022-03-21 | CVE-2022-0475 | Cross-site Scripting vulnerability in Otrs Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). | 5.4 |
| 2022-03-21 | CVE-2022-1004 | Information Exposure vulnerability in Otrs Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled. | 4.3 |
| 2022-02-07 | CVE-2022-0473 | Cross-site Scripting vulnerability in Otrs OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. | 4.8 |
| 2021-10-18 | CVE-2021-36097 | Unspecified vulnerability in Otrs Agents are able to lock the ticket without the "Owner" permission. | 4.3 |
| 2021-09-06 | CVE-2021-36096 | Cleartext Storage of Sensitive Information vulnerability in Otrs Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. | 4.9 |
| 2021-09-06 | CVE-2021-36093 | Unspecified vulnerability in Otrs It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. | 5.3 |