CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2012-4733 – Debian Security Advisory 2671-1
https://notcve.org/view.php?id=CVE-2012-4733
23 May 2013 — Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors. Request Tracker (RT) v4.x anterior a v4.0.13 no aplica adecuadamente el permiso DeleteTicket y "la transición del ciclo de vida personalizado", lo que permite a usuarios remotos autenticados con el permiso ModifyTicket suprimir entradas a través de vectores no especif... • http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html • CWE-255: Credentials Management Errors •
CVSS: 9.1EPSS: 0%CPEs: 67EXPL: 0CVE-2012-4730
https://notcve.org/view.php?id=CVE-2012-4730
11 Nov 2012 — Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors. equest Tracker (RT) v3.8.x antes de v3.8.15 y v4.0.x antes de v4.0.8 permite a usuarios remotos autenticados con ModifySelf o privilegios adminuser para inyectar cabeceras arbitrarias de correo electrónico y realizar ataques de phishing u obtener información... • http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2012-4732
https://notcve.org/view.php?id=CVE-2012-4732
11 Nov 2012 — Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks. Vulnerabilidad de ejecución de falsificación de peticiones en sitios cruzados (CSRF) en Request Tracker (RT) v3.8.12 y otras versiones anteriores v3.8.15 y v4.0.6 y otras versiones antes de v4.0.8, permite a atacantes remotos secuestrar la autenticaci... • http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 67EXPL: 0CVE-2012-4734
https://notcve.org/view.php?id=CVE-2012-4734
11 Nov 2012 — Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link. Request Tracker (RT) 3.8.x antes de 3.8.15 y 4.0.x antes de 4.0.8 permite a atacantes remotos para llevar a cabo un ataque de "delegado confuso" al pasar por alto el mecanismo de protección CSRF y causar víctimas a "modificar el estado arbitrari... • http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 0%CPEs: 70EXPL: 0CVE-2012-4884
https://notcve.org/view.php?id=CVE-2012-4884
11 Nov 2012 — Argument injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors related to the GnuPG client. Vulnerabilidad de inyección de argumentos en Request Tracker (RT) v3.8.x antes de v3.8.15 y 4.0.x antes de v4.0.8, permite a atacantes remotos crear archivos de su elección a través de vectores no especificados relacionados con el cliente GnuPG. • http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 0CVE-2012-2769
https://notcve.org/view.php?id=CVE-2012-2769
15 Aug 2012 — Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the Extension::MobileUI extension before 1.02 for Best Practical Solutions RT 3.8.x and in Best Practical Solutions RT before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en la página de administración de temas en la extensión Extension::MobileUI anterior a v1.02 para (Best Practical Solutions RT) ... • http://lists.bestpractical.com/pipermail/rt-announce/2012-July/000208.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2012-2770
https://notcve.org/view.php?id=CVE-2012-2770
15 Aug 2012 — The Authen::ExternalAuth extension before 0.11 for Best Practical Solutions RT allows remote attackers to obtain a logged-in session via unspecified vectors related to the "URL of a RSS feed of the user." La extensión Authen::ExternalAuth anterior v0.11 para (Best Practical Solutions RT) permite a atacantes obtener una sesión con acceso a través de vectores no especificados relacionados con (URL of a RSS feed of the user). • http://lists.bestpractical.com/pipermail/rt-announce/2012-July/000208.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 170EXPL: 0CVE-2011-2082
https://notcve.org/view.php?id=CVE-2011-2082
04 Jun 2012 — The vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not update the password-hash algorithm for disabled user accounts, which makes it easier for context-dependent attackers to determine cleartext passwords, and possibly use these passwords after accounts are re-enabled, via a brute-force attack on the database. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0009. RT v3.x anterior a v3.8.12 y v4.x anteriores a v4.0.6 no actuali... • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-255: Credentials Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 170EXPL: 0CVE-2011-2083
https://notcve.org/view.php?id=CVE-2011-2083
04 Jun 2012 — Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Best Practical Solutions RT v3.x anteriores a v3.8.12 y v4.x anteriores a v4.0.6, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 170EXPL: 0CVE-2011-2084
https://notcve.org/view.php?id=CVE-2011-2084
04 Jun 2012 — Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to read (1) hashes of former passwords and (2) ticket correspondence history by leveraging access to a privileged account. Best Practical Solutions RT 3.x anteriores a 3.8.12 y 4.x anteriores a 4.0.6 permiten a usuarios autenticados remotos leer (1) hashes de contraseñas previas e (2) historial de correspondencia de tickets utilizando el acceso a una cuenta privilegiada. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •