CVSS: 9.8EPSS: 0%CPEs: 170EXPL: 0CVE-2011-4459
https://notcve.org/view.php?id=CVE-2011-4459
04 Jun 2012 — Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership. Best Practical Solutions RT 3.x anteriores a 3.8.12 y 4.x anteriores a 4.0.6 no deshabilitan apropiadamente los grupos, lo que permite a usuarios autenticados remotos evitar las restricciones de acceso previstas en determinadas circunstancias utilizando una pertenenc... • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 187EXPL: 0CVE-2011-4460
https://notcve.org/view.php?id=CVE-2011-4460
04 Jun 2012 — SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by leveraging access to a privileged account. Vulnerabilidad de inyección SQL en Best Practical Solutions RT 2.x y 3.x anteriores a 3.8.12 y 4.x anteriores 4.0.6. Permite a usuarios remotos ejecutar comandos SQL de su elección utilizando el acceso a una cuenta privilegiada. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 170EXPL: 0CVE-2011-5092
https://notcve.org/view.php?id=CVE-2011-5092
04 Jun 2012 — Best Practical Solutions RT 3.8.x before 3.8.12 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code and gain privileges via unspecified vectors, a different vulnerability than CVE-2011-4458 and CVE-2011-5093. Best Practical Solutions RT 3.8.x anteriores a 3.8.12 y 4.x anteriores a 4.0.6 permite a atacantes remotos ejecutar código arbitrario y escalar privilegios a través de vectores de ataque sin especificar. Una vulnerabilidad distinta a la CVE-2011-4458 y CVE-2011-5093. • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 15EXPL: 0CVE-2011-5093
https://notcve.org/view.php?id=CVE-2011-5093
04 Jun 2012 — Best Practical Solutions RT 4.x before 4.0.6 does not properly implement the DisallowExecuteCode option, which allows remote authenticated users to bypass intended access restrictions and execute arbitrary code by leveraging access to a privileged account, a different vulnerability than CVE-2011-4458 and CVE-2011-5092. Best Practical Solutions RT 4.x anteriores a 4.0.6 no implementa apropiadamente la opción DisallowExecuteCode, lo que permite a usuarios autenticados remotos evitar las restricciones de acces... • http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html • CWE-264: Permissions, Privileges, and Access Controls •