CVE-2019-18180

Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions.

• CWE-835

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
• https://community.otrs.com/security-advisory-2019-15-security-update-for-otrs-framework/Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
• https://community.otrs.com/security-advisory-2019-15-security-update-for-otrs-framework/Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

Published

Dec 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1816A vulnerability in the log subscription subsystem of the Cis…7.8
• CVE-2019-1817A vulnerability in the web proxy functionality of Cisco Asyn…7.5
• CVE-2019-18177In certain Citrix products, information disclosure can be ac…6.5
• CVE-2019-18178Real Time Engineers FreeRTOS+FAT 160919a has a use after fre…7.5
• CVE-2019-18179An issue was discovered in Open Ticket Request System (OTRS)…4.3
• CVE-2019-1818A vulnerability in the web-based management interface of Cis…6.5
• CVE-2019-18181In CloudVision Portal all releases in the 2018.1 and 2018.2 …7.8
• CVE-2019-18182pacman before 5.2 is vulnerable to arbitrary command injecti…9.8
• CVE-2019-18183pacman before 5.2 is vulnerable to arbitrary command injecti…9.8
• CVE-2019-18184Crestron DMC-STRO 1.0 devices allow remote command execution…9.8
• CVE-2019-18187Trend Micro OfficeScan versions 11.0 and XG (12.0) could be …7.5
• CVE-2019-18188Trend Micro Apex One could be exploited by an attacker utili…7.5