Missing file type check in avatar picture upload

SQL Injection via MySQL Quote Method

SSL Certificates are not checked for E-Mail Handling

Host header injection by attachments in web service

Passwords are written to Admin Log Module

Information disclouse and DoS via websocket push events

Agents are able to lock the ticket without the "Owner" permission

Unnecessary data is written to log if issues during indexing occurs

Password is send back to client

Code execution via System Configuration

Reflected XSS in authenticated agent context

Missing Cookie Flags

Denial-of-Service via SVG Rendering in Ticket

Missing CSRF protection

Insufficient access control

DoS attack using email

SMTP Password will be shown in cleartext on some SMTP errors

Upload of files outside application directory

Email with special content can lead to DoS

Bypass DedicatedAgentToCustomerGroups Setting

Possible information disclosure via External Interface

Possible XSS execution in customer information

Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing

XSS stored in survey answers

Possible user enumeration

Information exlosure in external interface

External pictures can be loaded even if not allowed by configuration

Stored XSS in process management

Stored XSS in System Configuration

Possible DoS via SQL Box

Tickets can be moved without permissions

Unsafe handling of AJAX calls

Incorrect handling of permissions in External Interface Config Item List module

Wrong Permission Handling in Document Search Article Meta Filters

Improper check of permissions in Generic Interface