CVSS: 2.6EPSS: 0%CPEs: 31EXPL: 0CVE-2013-5587
https://notcve.org/view.php?id=CVE-2013-5587
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions. Vulnerabilidad Cross-site scripting (XSS) en Request Tracker (RT) v4.x anterior a v4.0.13, cuando se configura MakeClicky, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través una URL en un ticket. NOTA: este problema se ha dividido desde CVE-2013-3371 debido a las diferentes versiones afectadas. • http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html http://secunia.com/advisories/53505 http://secunia.com/advisories/53522 http://www.debian.org/security/2012/dsa-2670 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 77EXPL: 0CVE-2013-3372
https://notcve.org/view.php?id=CVE-2013-3372
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors. Request Tracker (RT) v3.8.x anterior a v3.8.17 y v4.0.x anterior a v4.0.13 permite a atacantes remotos inyectar varias cabeceras HTTP Content-Disposition y, posiblemente, realizar ataques de cross-site scripting (XSS) a través de vectores no especificados. • http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html http://secunia.com/advisories/53505 http://secunia.com/advisories/53522 http://www.debian.org/security/2012/dsa-2670 http://www.osvdb.org/93607 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 77EXPL: 0CVE-2013-3371
https://notcve.org/view.php?id=CVE-2013-3371
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment. Vulnerabilidad Cross-site scripting (XSS) en Request Tracker (RT) v3.8.3 hasta v3.8.16 y v4.0.x anterior a v4.0.13 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del nombre de archivo de datos adjuntos. • http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html http://secunia.com/advisories/53505 http://secunia.com/advisories/53522 http://www.debian.org/security/2012/dsa-2670 http://www.osvdb.org/93608 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 19EXPL: 0CVE-2012-4733
https://notcve.org/view.php?id=CVE-2012-4733
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors. Request Tracker (RT) v4.x anterior a v4.0.13 no aplica adecuadamente el permiso DeleteTicket y "la transición del ciclo de vida personalizado", lo que permite a usuarios remotos autenticados con el permiso ModifyTicket suprimir entradas a través de vectores no especificados. • http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html http://secunia.com/advisories/53522 http://www.osvdb.org/93611 • CWE-255: Credentials Management Errors •
CVSS: 6.0EPSS: 0%CPEs: 77EXPL: 0CVE-2013-3369
https://notcve.org/view.php?id=CVE-2013-3369
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors. Request Tracker (RT) v3.8.x anterior a v3.8.17 y v4.0.x anterior a v4.0.13 permite a los usuarios remotos autenticados con los permisos para ver las páginas de administración para ejecutar a su elección los componentes privados a través de vectores no especificados. • http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html http://secunia.com/advisories/53505 http://secunia.com/advisories/53522 http://www.debian.org/security/2012/dsa-2670 http://www.osvdb.org/93610 •