CVE-2014-2553
published 2014-04-02CVE-2014-2553: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote…
PriorityP414low3.5CVSS 2.0
AVNACMAuSCNIPAN
EPSS
1.45%
70.0th percentile
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | otrs2 | < otrs2 3.3.6-1 (bullseye) | otrs2 3.3.6-1 (bullseye) |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv6.5MEDIUM
vendor_debian3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xw7v-pcmp-g44q: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3
ghsa_unreviewed·2022-05-17
CVE-2014-2553 [LOW] CWE-79 GHSA-xw7v-pcmp-g44q: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.
OSV
tiff regression
osv·2015-04-01·CVSS 6.5
tiff regression
tiff regression
USN-2553-1 fixed vulnerabilities in LibTIFF. One of the security fixes
caused a regression when saving certain TIFF files with a Predictor tag.
The problematic patch has been temporarily backed out until a more complete
fix is available.
We apologize for the inconvenience.
Original advisory details:
William Robinet discovered that LibTIFF incorrectly handled certain
malformed images. If a user or automated system were tricked into opening a
specially crafted image, a remote attacker could crash the application,
leading to a denial of service, or possibly execute arbitrary code with
user privileges. (CVE-2014-8127, CVE-2014-8128, CVE-2014-8129,
CVE-2014-8130)
Paris Zoumpouloglou discovered that LibTIFF incorrectly handled certain
malformed BMP images. If a user or autom
OSV
CVE-2014-2553: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3
osv·2014-04-02·CVSS 3.5
CVE-2014-2553 [LOW] CVE-2014-2553: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.
Debian
CVE-2014-2553: otrs2 - Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3....
vendor_debian·2014·CVSS 3.5
CVE-2014-2553 [LOW] CVE-2014-2553: otrs2 - Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3....
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.
Scope: local
bullseye: resolved (fixed in 3.3.6-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.opensuse.org/opensuse-updates/2014-04/msg00062.htmlhttp://secunia.com/advisories/57616https://www.otrs.com/security-advisory-2014-04-xss-issuehttp://lists.opensuse.org/opensuse-updates/2014-04/msg00062.htmlhttp://secunia.com/advisories/57616https://www.otrs.com/security-advisory-2014-04-xss-issue
2014-04-02
Published