Page 2 of 30 results (0.001 seconds)

CVSS: 9.1EPSS: 0%CPEs: 67EXPL: 0

CVE-2012-4730

https://notcve.org/view.php?id=CVE-2012-4730

11 Nov 2012 — Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors. equest Tracker (RT) v3.8.x antes de v3.8.15 y v4.0.x antes de v4.0.8 permite a usuarios remotos autenticados con ModifySelf o privilegios adminuser para inyectar cabeceras arbitrarias de correo electrónico y realizar ataques de phishing u obtener información... • http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0

CVE-2012-4732

https://notcve.org/view.php?id=CVE-2012-4732

11 Nov 2012 — Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks. Vulnerabilidad de ejecución de falsificación de peticiones en sitios cruzados (CSRF) en Request Tracker (RT) v3.8.12 y otras versiones anteriores v3.8.15 y v4.0.6 y otras versiones antes de v4.0.8, permite a atacantes remotos secuestrar la autenticaci... • http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 8.8EPSS: 0%CPEs: 67EXPL: 0

CVE-2012-4734

https://notcve.org/view.php?id=CVE-2012-4734

11 Nov 2012 — Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link. Request Tracker (RT) 3.8.x antes de 3.8.15 y 4.0.x antes de 4.0.8 permite a atacantes remotos para llevar a cabo un ataque de "delegado confuso" al pasar por alto el mecanismo de protección CSRF y causar víctimas a "modificar el estado arbitrari... • http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.1EPSS: 0%CPEs: 70EXPL: 0

CVE-2012-4884

https://notcve.org/view.php?id=CVE-2012-4884

11 Nov 2012 — Argument injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors related to the GnuPG client. Vulnerabilidad de inyección de argumentos en Request Tracker (RT) v3.8.x antes de v3.8.15 y 4.0.x antes de v4.0.8, permite a atacantes remotos crear archivos de su elección a través de vectores no especificados relacionados con el cliente GnuPG. • http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 0

CVE-2012-2769

https://notcve.org/view.php?id=CVE-2012-2769

15 Aug 2012 — Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the Extension::MobileUI extension before 1.02 for Best Practical Solutions RT 3.8.x and in Best Practical Solutions RT before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en la página de administración de temas en la extensión Extension::MobileUI anterior a v1.02 para (Best Practical Solutions RT) ... • http://lists.bestpractical.com/pipermail/rt-announce/2012-July/000208.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 0%CPEs: 170EXPL: 0

CVE-2011-2082

https://notcve.org/view.php?id=CVE-2011-2082

04 Jun 2012 — The vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not update the password-hash algorithm for disabled user accounts, which makes it easier for context-dependent attackers to determine cleartext passwords, and possibly use these passwords after accounts are re-enabled, via a brute-force attack on the database. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0009. RT v3.x anterior a v3.8.12 y v4.x anteriores a v4.0.6 no actuali... • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-255: Credentials Management Errors •

CVSS: 6.1EPSS: 0%CPEs: 170EXPL: 0

CVE-2011-2083

https://notcve.org/view.php?id=CVE-2011-2083

04 Jun 2012 — Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Best Practical Solutions RT v3.x anteriores a v3.8.12 y v4.x anteriores a v4.0.6, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.5EPSS: 0%CPEs: 170EXPL: 0

CVE-2011-2084

https://notcve.org/view.php?id=CVE-2011-2084

04 Jun 2012 — Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to read (1) hashes of former passwords and (2) ticket correspondence history by leveraging access to a privileged account. Best Practical Solutions RT 3.x anteriores a 3.8.12 y 4.x anteriores a 4.0.6 permiten a usuarios autenticados remotos leer (1) hashes de contraseñas previas e (2) historial de correspondencia de tickets utilizando el acceso a una cuenta privilegiada. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 8.8EPSS: 0%CPEs: 196EXPL: 0

CVE-2011-2085

https://notcve.org/view.php?id=CVE-2011-2085

04 Jun 2012 — Multiple cross-site request forgery (CSRF) vulnerabilities in Best Practical Solutions RT before 3.8.12 and 4.x before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Best Practical Solutions RT anteriores a 3.8.12 y 4.x anteriores a 4.0.6. Permiten a usuarios remotos secuestrar (hijack) la autenticación de usuarios arbitrarios. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 9.8EPSS: 1%CPEs: 86EXPL: 0

CVE-2011-4458

https://notcve.org/view.php?id=CVE-2011-4458

04 Jun 2012 — Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093. Best Practical Solutions RT 3.6.x, 3.7.x, 3.8.x anteriores a 3.8.12 y 4.x anteriores a 4.0.6, si las opciones VERPPrefix y VERPDomain están habilitadas, permiten a atacantes remotos ejecutar código arbitrario a través de vectores... • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •