CVSS: 5.8EPSS: 0%CPEs: 40EXPL: 0CVE-2009-3585
https://notcve.org/view.php?id=CVE-2009-3585
Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages a second web server within the same domain. Vulnerabilidad de permanencia de sesión en html/Elements/SetupSessionCookie en Best Practical Solutions RT desde v3.0.0 hasta v3.6.9 y desde v3.8.x hasta v3.8.5 permite a atacantes remotos secuestrar sesiones web fijando el identificador de sesión a través de una manipulación que aprovecha un segundo servidor web dentro del mismo dominio. • http://bestpractical.typepad.com/files/rt-3.0.0-session_fixation.v3.patch http://bestpractical.typepad.com/files/rt-3.0.1-3.0.6-session_fixation.v3.patch http://bestpractical.typepad.com/files/rt-3.0.7-3.6.1-session_fixation.v3.patch http://bestpractical.typepad.com/files/rt-3.6.2-3.6.3-session_fixation.v3.patch http://bestpractical.typepad.com/files/rt-3.6.4-3.6.9-session_fixation.v2.patch http://bestpractical.typepad.com/files/rt-3.8-session_fixation.patch http: • CWE-287: Improper Authentication •
CVSS: 5.8EPSS: 0%CPEs: 40EXPL: 0CVE-2009-4151
https://notcve.org/view.php?id=CVE-2009-4151
Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages "HTTP access to the RT server," a related issue to CVE-2009-3585. Vulnerabilidad de fijación de sesión en /Elements/SetupSessionCookie en Best Practical Solutions RT v3.0.0 a la v3.6.9 y v3.8.x a la v3.8.5, permite a atacantes remotos secuestrar sesiones web manipulando el identificador de sesión lo que permite "Un acceso HTTP al servidor RT". Relacionado con el CVE-2009-3585. • http://bestpractical.typepad.com/files/rt-3.0.0-session_fixation.v3.patch http://bestpractical.typepad.com/files/rt-3.0.1-3.0.6-session_fixation.v3.patch http://bestpractical.typepad.com/files/rt-3.0.7-3.6.1-session_fixation.v3.patch http://bestpractical.typepad.com/files/rt-3.6.2-3.6.3-session_fixation.v3.patch http://bestpractical.typepad.com/files/rt-3.6.4-3.6.9-session_fixation.v2.patch http://bestpractical.typepad.com/files/rt-3.8-session_fixation.patch http: • CWE-287: Improper Authentication •
CVSS: 4.0EPSS: 0%CPEs: 32EXPL: 0CVE-2008-3502
https://notcve.org/view.php?id=CVE-2008-3502
Unspecified vulnerability in Best Practical Solutions RT 3.0.0 through 3.6.6 allows remote authenticated users to cause a denial of service (CPU or memory consumption) via unspecified vectors related to the Devel::StackTrace module for Perl. Vulnerabilidad no especificada en Best Practical Solutions RT 3.0.0 hasta 3.6.6 permite a usuarios remotos autenticados provocar una denegación de servicio (agotamiento de CPU o memoria) a través de vectores no especificados relacionados con el módulo Devel::StackTrace de Perl. • http://lists.bestpractical.com/pipermail/rt-announce/2008-June/000158.html http://secunia.com/advisories/30830 http://www.securityfocus.com/bid/29925 https://exchange.xforce.ibmcloud.com/vulnerabilities/43337 •