https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T20:24:34.260676+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-04778 cnvd-2018-04778 2026-10-18T20:24:34.265002+00:00 cnvd-2018-04778 https://cve.radiocsirt.org/vuln/euvd-2026-63328 EUVD-2026-63328 2026-10-18T20:24:34.265058+00:00 EUVD-2026-63328 https://cve.radiocsirt.org/vuln/fkie_cve-2018-7567 fkie_cve-2018-7567 2026-10-18T20:24:34.265073+00:00

In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server during package installation. NOTE: the vendor disputes this issue stating "the behaviour is as designed and needed for different packages to be installed", "there is a security warning if the package is not verified by OTRS Group", and "there is the possibility and responsibility of an admin to check packages before installation which is possible as they are not binary.

 https://cve.radiocsirt.org/vuln/ghsa-pxj8-jw6j-jj8v GHSA-pxj8-jw6j-jj8v 2026-10-18T20:24:34.265107+00:00

** DISPUTED ** In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server during package installation. NOTE: the vendor disputes this issue stating "the behaviour is as designed and needed for different packages to be installed", "there is a security warning if the package is not verified by OTRS Group", and "there is the possibility and responsibility of an admin to check packages before installation which is possible as they are not binary."

 https://cve.radiocsirt.org/vuln/gsd-2018-7567 gsd-2018-7567 2026-10-18T20:24:34.265129+00:00 gsd-2018-7567 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-7567 Withdrawn: UBUNTU-CVE-2018-7567 2026-10-18T20:24:34.265140+00:00

Withdrawn by the publisher.

Affected: Ubuntu:16.04:LTS: otrs2, Ubuntu:18.04:LTS: otrs2

In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server during package installation. NOTE: the vendor disputes this issue stating "the behaviour is as designed and needed for different packages to be installed", "there is a security warning if the package is not verified by OTRS Group", and "there is the possibility and responsibility of an admin to check packages before installation which is possible as they are not binary.