CVE-2017-5944

The dashboard subscription interface in Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name...

DEBIAN-CVE-2017-5361

Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack...

CVE-2017-5943

CVE-2017-5943 affects Request Tracker (RT) 4.x series. A remote attacker can obtain CSRF verification tokens by sending a crafted URL, enabling leakage of token data. Affected versions include RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2. CVSS appears high (8.8) with network ...

CVE-2016-6127

Cross-site scripting XSS vulnerability in Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified conten...

CVE-2017-5943

Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery CSRF verification tokens via a crafted URL...

CVE-2017-5361

Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack...

CVE-2017-5361

CVE-2017-5361 affects Request Tracker (RT) 4.x prior to 4.0.25, 4.2.x prior to 4.2.14, and 4.4.x prior to 4.4.2. Root cause: RT did not use a constant-time comparison for secrets, enabling remote timing side-channel observations to leak sensitive password information. Impact: partial confidential...

CVE-2017-5944

The CVE-2017-5944 issue affects Best Practical Solutions RT 4.x, specifically versions before 4.0.25 (4.0.x), before 4.2.14 (4.2.x), and before 4.4.2 (4.4.x). The vulnerability arises in the dashboard subscription interface where a remote authenticated user with certain privileges can trigger arb...

CVE-2017-5944

The dashboard subscription interface in Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name...

CVE-2017-5361

Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack...

CVE-2017-5944

The dashboard subscription interface in Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name...

CVE-2016-6127

CVE-2016-6127: In RT 4.x, an XSS vulnerability exists via file uploads when AlwaysDownloadAttachments is not enabled. Affected versions are RT 4.0.x up to 4.0.25, 4.2.x up to 4.2.14, and 4.4.x up to 4.4.2. Remote attackers can inject arbitrary web script/HTML through a file upload with an unspeci...

CVE-2016-6127

Cross-site scripting XSS vulnerability in Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified conten...

Analytics Tracker < 1.1.1 - XSS

The Analytics Tracker WordPress plugin was affected by a XSS security vulnerability...

Debian DLA-988-1 : rt-authen-externalauth security update

It was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI database mode is vulnerable. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DSA-3882-1 : request-tracker4 - security update

Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-6127 It was discovered that Request Tracker is vulnerable to a cross-site scripting XSS...

[SECURITY] [DLA 987-1] request-tracker4 security update

Package : request-tracker4 Version : 4.0.7-5+deb7u5 CVE ID : CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the...

[SECURITY] [DSA 3883-1] rt-authen-externalauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3883-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 15, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3882-1] request-tracker4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3882-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 15, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3882-1 (request-tracker4 - security update)

Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-6127 It was discovered that Request Tracker is vulnerable to a cross-site scripting XSS atta...