Page 3 of 20 results (0.002 seconds)

CVSS: 4.3EPSS: 0%CPEs: 79EXPL: 0

CVE-2011-1689

https://notcve.org/view.php?id=CVE-2011-1689

Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Best Practical Solutions RT v2.0.0 hasta v3.6.10, v3.8.0 hasta v3.8.9, y v4.0.0rc hasta 4.0.0rc7, permite a atacantes remotos inyectar script de su elección o HTML a través desconocidos. • http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html http://secunia.com/advisories/44189 http://www.debian.org/security/2011/dsa-2220 http://www.securityfocus.com/bid/47383 http://www.vupen.com/english/advisories/2011/1071 https://bugzilla.red • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.0EPSS: 0%CPEs: 61EXPL: 0

CVE-2011-1687

https://notcve.org/view.php?id=CVE-2011-1687

Best Practical Solutions RT 3.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote authenticated users to obtain sensitive information by using the search interface, as demonstrated by retrieving encrypted passwords. Best Practical Solutions RT v2.0.0 hasta v3.6.10, v3.8.0 hasta v3.8.9, y v4.0.0rc hasta 4.0.0rc7 permite a usuarios remotos autenticados, obtener información confidencial mediante el uso de la interfaz de búsqueda, como lo demuestra la recuperación de contraseñas codificadas. • http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html http://secunia.com/advisories/44189 http://www.debian.org/security/2011/dsa-2220 http://www.securityfocus.com/bid/47383 http://www.vupen.com/english/advisories/2011/1071 https://bugzilla.red • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 25EXPL: 0

CVE-2011-1690

https://notcve.org/view.php?id=CVE-2011-1690

Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 through 3.8.8 allows remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors. Best Practical Solutions RT v3.6.0 hasta v3.6.10 y v3.8.0 hasta v3.8.8 permite a atacantes remotos engañar a los usuarios para que envíen las credenciales a un servidor de su elección a través de vectores no especificados. • http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html http://secunia.com/advisories/44189 http://www.debian.org/security/2011/dsa-2220 http://www.securityfocus.com/bid/47383 http://www.vupen.com/english/advisories/2011/1071 https://bugzilla.red • CWE-255: Credentials Management Errors •

CVSS: 4.3EPSS: 0%CPEs: 47EXPL: 0

CVE-2011-1688

https://notcve.org/view.php?id=CVE-2011-1688

Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request. Vulnerabilidad de salto de directorio en Best Practical Solutions RT v2.0.0 hasta v3.6.10, v3.8.0 hasta v3.8.9, y v4.0.0rc hasta 4.0.0rc7 permite a atacantes remotos leer ficheros arbitrarios mediante una petición HTTP manipulada. • http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html http://secunia.com/advisories/44189 http://www.debian.org/security/2011/dsa-2220 http://www.securityfocus.com/bid/47383 http://www.vupen.com/english/advisories/2011/1071 https://bugzilla.red • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 4.0EPSS: 0%CPEs: 76EXPL: 0

CVE-2011-1008

https://notcve.org/view.php?id=CVE-2011-1008

Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, related to SQL logging. Scrips_Overlay.pm en Best Practical Solutions RT anterior a v3.8.9 no restringe el acceso adecuadamente a TicketObj en un Scrip después de un cambio en CurrentUser, lo que permite a usuarios autenticados obtener información sensible a través de vectores no especificados, como se demostró por el valor de información custom-field, relacionado con el registro SQL. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576 http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html http://openwall.com/lists/oss-security/2011/02/22/12 http://openwall.com/lists/oss-security/2011/02/22/16 http://openwall.com/lists/oss-security/2011/02/22/6 http://openwall.com/lists/oss-security/2011/02/23/22 http://openwall.com/lists/oss-security/2011/02/24/7 http://openwall.com/lists/oss-security/2011/02/24/8 http • CWE-264: Permissions, Privileges, and Access Controls •