CVSS: 6.5EPSS: 0%CPEs: 170EXPL: 0CVE-2011-2084
https://notcve.org/view.php?id=CVE-2011-2084
04 Jun 2012 — Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to read (1) hashes of former passwords and (2) ticket correspondence history by leveraging access to a privileged account. Best Practical Solutions RT 3.x anteriores a 3.8.12 y 4.x anteriores a 4.0.6 permiten a usuarios autenticados remotos leer (1) hashes de contraseñas previas e (2) historial de correspondencia de tickets utilizando el acceso a una cuenta privilegiada. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 170EXPL: 0CVE-2011-2082
https://notcve.org/view.php?id=CVE-2011-2082
04 Jun 2012 — The vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not update the password-hash algorithm for disabled user accounts, which makes it easier for context-dependent attackers to determine cleartext passwords, and possibly use these passwords after accounts are re-enabled, via a brute-force attack on the database. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0009. RT v3.x anterior a v3.8.12 y v4.x anteriores a v4.0.6 no actuali... • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-255: Credentials Management Errors •
CVSS: 8.8EPSS: 0%CPEs: 196EXPL: 0CVE-2011-2085
https://notcve.org/view.php?id=CVE-2011-2085
04 Jun 2012 — Multiple cross-site request forgery (CSRF) vulnerabilities in Best Practical Solutions RT before 3.8.12 and 4.x before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Best Practical Solutions RT anteriores a 3.8.12 y 4.x anteriores a 4.0.6. Permiten a usuarios remotos secuestrar (hijack) la autenticación de usuarios arbitrarios. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 1%CPEs: 170EXPL: 0CVE-2011-5092
https://notcve.org/view.php?id=CVE-2011-5092
04 Jun 2012 — Best Practical Solutions RT 3.8.x before 3.8.12 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code and gain privileges via unspecified vectors, a different vulnerability than CVE-2011-4458 and CVE-2011-5093. Best Practical Solutions RT 3.8.x anteriores a 3.8.12 y 4.x anteriores a 4.0.6 permite a atacantes remotos ejecutar código arbitrario y escalar privilegios a través de vectores de ataque sin especificar. Una vulnerabilidad distinta a la CVE-2011-4458 y CVE-2011-5093. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 170EXPL: 0CVE-2011-2083
https://notcve.org/view.php?id=CVE-2011-2083
04 Jun 2012 — Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Best Practical Solutions RT v3.x anteriores a v3.8.12 y v4.x anteriores a v4.0.6, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 86EXPL: 0CVE-2011-4458
https://notcve.org/view.php?id=CVE-2011-4458
04 Jun 2012 — Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093. Best Practical Solutions RT 3.6.x, 3.7.x, 3.8.x anteriores a 3.8.12 y 4.x anteriores a 4.0.6, si las opciones VERPPrefix y VERPDomain están habilitadas, permiten a atacantes remotos ejecutar código arbitrario a través de vectores... • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 170EXPL: 0CVE-2011-4459
https://notcve.org/view.php?id=CVE-2011-4459
04 Jun 2012 — Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership. Best Practical Solutions RT 3.x anteriores a 3.8.12 y 4.x anteriores a 4.0.6 no deshabilitan apropiadamente los grupos, lo que permite a usuarios autenticados remotos evitar las restricciones de acceso previstas en determinadas circunstancias utilizando una pertenenc... • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 187EXPL: 0CVE-2011-4460
https://notcve.org/view.php?id=CVE-2011-4460
04 Jun 2012 — SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by leveraging access to a privileged account. Vulnerabilidad de inyección SQL en Best Practical Solutions RT 2.x y 3.x anteriores a 3.8.12 y 4.x anteriores 4.0.6. Permite a usuarios remotos ejecutar comandos SQL de su elección utilizando el acceso a una cuenta privilegiada. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 15EXPL: 0CVE-2011-5093
https://notcve.org/view.php?id=CVE-2011-5093
04 Jun 2012 — Best Practical Solutions RT 4.x before 4.0.6 does not properly implement the DisallowExecuteCode option, which allows remote authenticated users to bypass intended access restrictions and execute arbitrary code by leveraging access to a privileged account, a different vulnerability than CVE-2011-4458 and CVE-2011-5092. Best Practical Solutions RT 4.x anteriores a 4.0.6 no implementa apropiadamente la opción DisallowExecuteCode, lo que permite a usuarios autenticados remotos evitar las restricciones de acces... • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 61EXPL: 0CVE-2011-1687
https://notcve.org/view.php?id=CVE-2011-1687
22 Apr 2011 — Best Practical Solutions RT 3.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote authenticated users to obtain sensitive information by using the search interface, as demonstrated by retrieving encrypted passwords. Best Practical Solutions RT v2.0.0 hasta v3.6.10, v3.8.0 hasta v3.8.9, y v4.0.0rc hasta 4.0.0rc7 permite a usuarios remotos autenticados, obtener información confidencial mediante el uso de la interfaz de búsqueda, como lo demuestra la recuperación de contraseñas ... • http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •