deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-0609
Published: 2011-03-15
Description: Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.
CVSS Score: 7.8 (HIGH)
References: http://blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.html; http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates_15.html; http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
CVE: CVE-2011-0695
Published: 2011-03-15
Description: Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand request while other request handlers are still running, which triggers an invalid pointer dereference.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2011-0927.html; http://secunia.com/advisories/43693; http://www.openwall.com/lists/oss-security/2011/03/11/1
CVE: CVE-2011-1092
Published: 2011-03-15
Description: Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmop_read function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://bugs.php.net/bug.php?id=54193; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2507&w=2
CVE: CVE-2011-1146
Published: 2011-03-15
Description: libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617773; http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=71753cb7f7a16ff800381c0b5ee4e99eea92fed3; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056209.html
CVE: CVE-2011-1147
Published: 2011-03-15
Description: Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x before 1.4.39.2, 1.6.1.x before 1.6.1.22, 1.6.2.x before 1.6.2.16.2, and 1.8 before 1.8.2.4; Business Edition C.x.x before C.3.6.3; AsteriskNOW 1.5; and s800i (Asterisk Appliance), when T.38 support is enabled, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDPTL packet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2011-002.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055030.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055421.html
CVE: CVE-2011-1427
Published: 2011-03-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 5.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Language parameter to Pages/login.aspx, (2) HeaderWarning parameter to Troubleshooting/DiagnosticReport.asp, or (3) User-Agent header to troubleshooting/speedtest.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8135; http://www.securityfocus.com/archive/1/516880/100/0/threaded; http://www.securityfocus.com/archive/1/516881/100/0/threaded
CVE: CVE-2011-0322
Published: 2011-03-16
Description: Unspecified vulnerability in EMC RSA Access Manager Server 5.5.x, 6.0.x, and 6.1.x allows remote attackers to access resources via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/43796; http://securityreason.com/securityalert/8142; http://www.securityfocus.com/archive/1/517023/100/0/threaded
CVE: CVE-2011-0411
Published: 2011-03-16
Description: The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056559.html
CVE: CVE-2011-0442
Published: 2011-03-16
Description: The service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to transmit event details in (1) service requests and (2) e-mail messages, which might allow remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 3.5 (LOW)
CWE: CWE-310
References: http://secunia.com/advisories/43797; http://securityreason.com/securityalert/8139; http://www.securityfocus.com/archive/1/517022/100/0/threaded
CVE: CVE-2011-0648
Published: 2011-03-16
Description: Unspecified vulnerability in EMC Avamar before 5.0.4-30 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 8.5 (HIGH)
References: http://osvdb.org/71181; http://secunia.com/advisories/43749; http://securityreason.com/securityalert/8138
CVE: CVE-2011-0745
Published: 2011-03-16
Description: SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/8141; http://www.redteam-pentesting.de/advisories/rt-sa-2011-002; http://www.securityfocus.com/archive/1/517027/100/0/threaded
CVE: CVE-2011-0751
Published: 2011-03-16
Description: Directory traversal vulnerability in nhttpd (aka Nostromo webserver) before 1.9.4 allows remote attackers to execute arbitrary programs or read arbitrary files via a ..%2f (encoded dot dot slash) in a URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/71235; http://secunia.com/advisories/43775; http://securityreason.com/securityalert/8140
CVE: CVE-2011-0889
Published: 2011-03-16
Description: Unspecified vulnerability in HP Client Automation Enterprise (aka HPCA or Radia Notify) 5.11, 7.2, 7.5, 7.8, and 7.9 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/71179; http://seclists.org/bugtraq/2011/Mar/132; http://secunia.com/advisories/43766
CVE: CVE-2011-1094
Published: 2011-03-16
Description: kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2011/03/08/13; http://openwall.com/lists/oss-security/2011/03/08/20; http://secunia.com/advisories/44108
CVE: CVE-2011-1153
Published: 2011-03-16
Description: Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zend_throw_exception_ex call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://bugs.php.net/bug.php?id=54247; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057709.html
CVE: CVE-2011-1428
Published: 2011-03-16
Description: Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, related to incorrect use of the GnuTLS API.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0671.html; http://git.savannah.gnu.org/gitweb/?p=weechat.git%3Ba=commit%3Bh=c265cad1c95b84abfd4e8d861f25926ef13b5d91; http://savannah.nongnu.org/patch/index.php?7459
CVE: CVE-2011-1429
Published: 2011-03-16
Description: Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061353.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061356.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061461.html
CVE: CVE-2011-1430
Published: 2011-03-16
Description: The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/43676; http://www.kb.cert.org/vuls/id/555316; http://www.kb.cert.org/vuls/id/MAPG-8DBRD4
CVE: CVE-2011-1431
Published: 2011-03-16
Description: The STARTTLS implementation in qmail-smtpd.c in qmail-smtpd in the netqmail-1.06-tls patch for netqmail 1.06 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
CVSS Score: 6.8 (MEDIUM)
References: http://inoa.net/qmail-tls/vu555316.patch; http://securityreason.com/securityalert/8144; http://www.kb.cert.org/vuls/id/555316
CVE: CVE-2011-1432
Published: 2011-03-16
Description: The STARTTLS implementation in SCO SCOoffice Server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
CVSS Score: 6.8 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/555316; http://www.kb.cert.org/vuls/id/MAPG-8D9M6A; http://www.securityfocus.com/bid/46767
CVE: CVE-2011-1148
Published: 2011-03-18
Description: Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://bugs.php.net/bug.php?id=54238; http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2507&w=2
CVE: CVE-2008-7275
Published: 2011-03-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) before 2.3.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) AgentTicketMailbox or (2) CustomerTicketOverView.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.otrs.org/show_bug.cgi?id=3287; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=3287
CVE: CVE-2008-7276
Published: 2011-03-18
Description: Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass intended access restrictions via standard filesystem operations, related to incorrect interpretation of 0700 as a decimal value.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://bugs.otrs.org/show_bug.cgi?id=3133; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=3133
CVE: CVE-2008-7277
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://bugs.otrs.org/show_bug.cgi?id=3045; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=3045
CVE: CVE-2008-7278
Published: 2011-03-18
Description: The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.otrs.org/show_bug.cgi?id=2539; http://bugs.otrs.org/show_bug.cgi?id=2844; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
CVE: CVE-2008-7279
Published: 2011-03-18
Description: The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://bugs.otrs.org/show_bug.cgi?id=3103; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=3103
CVE: CVE-2008-7280
Published: 2011-03-18
Description: Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.otrs.org/show_bug.cgi?id=2934; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=2934
CVE: CVE-2008-7281
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://bugs.otrs.org/show_bug.cgi?id=1882; http://bugs.otrs.org/show_bug.cgi?id=2814; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
CVE: CVE-2008-7282
Published: 2011-03-18
Description: Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain (1) list and (2) write operations on queues, via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://bugs.otrs.org/show_bug.cgi?id=2696; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=2696
CVE: CVE-2008-7283
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.otrs.org/show_bug.cgi?id=2544; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=2544
CVE: CVE-2009-5055
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the CustomerID 12 account to read tickets that should be available only to CustomerID 1 or CustomerID 2.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://bugs.otrs.org/show_bug.cgi?id=4105; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=4105
CVE: CVE-2009-5056
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-tickets list.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://bugs.otrs.org/show_bug.cgi?id=3583; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=3583
CVE: CVE-2009-5057
Published: 2011-03-18
Description: The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://bugs.otrs.org/show_bug.cgi?id=3462; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=3462
CVE: CVE-2010-4758
Published: 2011-03-18
Description: installer.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://bugs.otrs.org/show_bug.cgi?id=6302; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=6302
CVE: CVE-2010-4759
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to cause a denial of service (daemon hang) via a fulltext search.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.otrs.org/show_bug.cgi?id=1639; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=1639
CVE: CVE-2010-4760
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote authenticated users to obtain potentially sensitive information by reading a ticket.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://bugs.otrs.org/show_bug.cgi?id=5975; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=5975
CVE: CVE-2010-4761
Published: 2011-03-18
Description: The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the (1) responsible, (2) owner, (3) accounted time, (4) pending until, and (5) lock fields by reading this dialog.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.otrs.org/show_bug.cgi?id=5875; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=5875
CVE: CVE-2010-4762
Published: 2011-03-18
Description: Cross-site scripting (XSS) vulnerability in the rich-text-editor component in Open Ticket Request System (OTRS) before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://bugs.otrs.org/show_bug.cgi?id=5724; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=5724
CVE: CVE-2010-4763
Published: 2011-03-18
Description: The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the (1) Status, (2) Service, and (3) Queue via selections.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://bugs.otrs.org/show_bug.cgi?id=4399; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=4399
CVE: CVE-2010-4764
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages that were based on revoked PGP or GPG keys, which makes it easier for remote attackers to spoof e-mail communication by leveraging a key that has a revocation signature.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://bugs.otrs.org/show_bug.cgi?id=6131; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=6131
CVE: CVE-2010-4765
Published: 2011-03-18
Description: Race condition in the Kernel::System::Main::FileWrite method in Open Ticket Request System (OTRS) before 2.4.8 allows remote authenticated users to corrupt the TicketCounter.log data in opportunistic circumstances by creating tickets.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-362
References: http://bugs.otrs.org/show_bug.cgi?id=4936; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=4936
CVE: CVE-2010-4766
Published: 2011-03-18
Description: The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a standard e-mail client.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugs.otrs.org/show_bug.cgi?id=4818; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=4818
CVE: CVE-2010-4767
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset, which allows remote attackers to cause a denial of service (duplicate tickets and duplicate auto-responses) by sending a crafted message to a POP3 mailbox.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.otrs.org/show_bug.cgi?id=3426; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=3426