CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5475
https://notcve.org/view.php?id=CVE-2015-5475
Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages. Múltiples vulnerabilidades de XSS en Request Tracker (RT) en la versión 4.x y anteriores a 4.2.12, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores relacionados con (1) el usuario o (2) páginas de gestión de derechos de grupo. • http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164607.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165124.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165163.html http://www.debian.org/security/2015/dsa-3335 http://www.securityfocus.com/bid/76364 https://bestpractical.com/release-notes/rt/4.2.12 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 13EXPL: 0CVE-2015-1464
https://notcve.org/view.php?id=CVE-2015-1464
RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL. RT (también conocido como Request Tracker) anterior a 4.0.23 y 4.2.x anterior a 4.2.10 permite a atacantes remotos secuestrar sesiones a través de una URL de alimentación RSS. • http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154213.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154047.html http://www.debian.org/security/2015/dsa-3176 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 32%CPEs: 24EXPL: 3CVE-2013-3525 – Request Tracker - 'ShowPending' SQL Injection
https://notcve.org/view.php?id=CVE-2013-3525
SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims. ** DISPUTADA ** Vulnerabilidad de inyección SQL en Approvals/ en Request Tracker (RT) 4.0.10 y anteriores permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro ShowPending. NOTA: el proveedor disputa este problema, diciendo que 'No somo capaces de reproducirlo, y el individuo que lo anuncio han retractado su informe,' y 'habíamos verificado que la explotación afirmada no funcionaba según las afirmaciones del autor.' • https://www.exploit-db.com/exploits/38459 http://blog.bestpractical.com/2013/04/on-our-security-policies.html http://cxsecurity.com/issue/WLB-2013040083 http://osvdb.org/92265 http://packetstormsecurity.com/files/121245/RT-Request-Tracker-4.0.10-SQL-Injection.html http://www.securityfocus.com/bid/59022 https://exchange.xforce.ibmcloud.com/vulnerabilities/83375 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2006-2169
https://notcve.org/view.php?id=CVE-2006-2169
RT: Request Tracker 3.5.HEAD allows remote attackers to obtain sensitive information via the Rows parameter in Dist/Display.html, which reveals the installation path in an error message. • http://pridels0.blogspot.com/2006/04/rt-request-tracker-vuln.html https://exchange.xforce.ibmcloud.com/vulnerabilities/26164 •