5 results (0.012 seconds)

CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 0

CVE-2012-2769

https://notcve.org/view.php?id=CVE-2012-2769

15 Aug 2012 — Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the Extension::MobileUI extension before 1.02 for Best Practical Solutions RT 3.8.x and in Best Practical Solutions RT before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en la página de administración de temas en la extensión Extension::MobileUI anterior a v1.02 para (Best Practical Solutions RT) ... • http://lists.bestpractical.com/pipermail/rt-announce/2012-July/000208.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 196EXPL: 0

CVE-2011-2085

https://notcve.org/view.php?id=CVE-2011-2085

24 May 2012 — Multiple cross-site request forgery (CSRF) vulnerabilities in Best Practical Solutions RT before 3.8.12 and 4.x before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Best Practical Solutions RT anteriores a 3.8.12 y 4.x anteriores a 4.0.6. Permiten a usuarios remotos secuestrar (hijack) la autenticación de usuarios arbitrarios. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 9.4EPSS: 0%CPEs: 76EXPL: 0

CVE-2011-1007

https://notcve.org/view.php?id=CVE-2011-1007

28 Feb 2011 — Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout. Best Practical Solutions RT anterior a v3.8.9 no desarrolla ciertas redirecciones en el login, lo que permite a atacantes próximos físicamente obtener credenciales reenviando el formulario de registro a través del botón back en un b... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614575 • CWE-255: Credentials Management Errors •

CVSS: 6.5EPSS: 0%CPEs: 76EXPL: 0

CVE-2011-1008

https://notcve.org/view.php?id=CVE-2011-1008

28 Feb 2011 — Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, related to SQL logging. Scrips_Overlay.pm en Best Practical Solutions RT anterior a v3.8.9 no restringe el acceso adecuadamente a TicketObj en un Scrip después de un cambio en CurrentUser, lo que permite a usuarios... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.8EPSS: 0%CPEs: 150EXPL: 0

CVE-2011-0009

https://notcve.org/view.php?id=CVE-2011-0009

24 Jan 2010 — Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier for context-dependent attackers to determine cleartext passwords via a brute-force attack on the database. Best Practical Solutions RT v3.x anterior a v3.8.9rc2 y v4.x, utiliza el algoritmo MD5 para los hashes de contraseñas, lo que hace que sea más fácil para los atacantes dependientes del contexto determinar las contraseñas sin cifrar a través de un ataque de fuerza bru... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610850 • CWE-310: Cryptographic Issues •