Best Practical Request Tracker Security Vulnerability

Best Practical Request Tracker is an event tracking system written in Perl. A security vulnerability exists in versions of Best Practical Request Tracker prior to 4.4.3-2+deb10u3, which originates from a vulnerability that can easily disclose information via response messages returned from reques...

Best Practical Request Tracker Security Vulnerability

Best Practical Request Tracker is an event tracking system written in Perl. A security vulnerability exists in versions prior to Best Practical Request Tracker 4.4.3-2+deb10u3, which stems from the ease of accepting unvalidated RT email headers in incoming emails and mail gateway REST interfaces...

Debian: Security Advisory (DSA-5541-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5541-1 : request-tracker5 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5541 advisory. - Request Tracker reports: CVE-2023-41259 SECURITY: RT is vulnerable to unvalidated email headers in incoming email and the mail-gateway REST interface...

Debian dla-3642 : request-tracker4 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3642 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3642-1 [email protected]...

DLA-3642-1 request-tracker4 - security update

Bulletin has no description...

PT-2023-29363 · Best Practical · Request Tracker

Name of the Vulnerable Software and Affected Versions: Best Practical Request Tracker RT versions 5.0.0 through 5.0.4 Description: The issue allows Information Disclosure via a transaction search in the transaction query builder. Recommendations: For versions 5.0.0 through 5.0.4, update to versio...

PT-2023-6733 · Best Practical +2 · Request Tracker +2

Name of the Vulnerable Software and Affected Versions: Best Practical Request Tracker RT versions 4.4.6 and earlier Best Practical Request Tracker RT versions 5.0.4 and earlier Description: The issue allows Information Disclosure via fake or spoofed RT email headers in an email message or a...

PT-2023-6715 · Unknown +2 · Request Tracker +2

Name of the Vulnerable Software and Affected Versions: Request Tracker RT versions 4.4.6 and earlier Request Tracker RT versions 5.x prior to 5.0.5 Description: The issue allows information exposure in responses to mail-gateway REST API calls. This is due to excessive data output by the applicati...

Vulnerabilities in Best Practical RT fixed

Vulnerabilities have been fixed in Best Practical Request Tracker RT. The vulnerabilities allow an unauthenticated malicious person able to impersonate an RT user and to download specific email attachments to download. Best Practical has released updates to fix the vulnerabilities fixes in RT. Fo...

FreeBSD : Request Tracker -- multiple vulnerabilities (e14b9870-62a4-11ee-897b-000bab9f87f1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e14b9870-62a4-11ee-897b-000bab9f87f1 advisory. - Request Tracker reports: CVE-2023-41259 SECURITY: RT is vulnerable to unvalidated email...

Request Tracker -- multiple vulnerabilities

Request Tracker reports: CVE-2023-41259 SECURITY: RT is vulnerable to unvalidated email headers in incoming email and the mail-gateway REST interface. CVE-2023-41260 SECURITY: RT is vulnerable to information leakage via response messages returned from requests sent via the mail-gateway REST...

SUSE CVE-2013-3525

SQL injection vulnerability in Approvals/ in Request Tracker RT 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted...

SUSE CVE-2015-5475

Multiple cross-site scripting XSS vulnerabilities in Request Tracker RT 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 user and 2 group rights management pages...

SUSE CVE-2015-6506

Cross-site scripting XSS vulnerability in the cryptography interface in Request Tracker RT before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key...

SUSE CVE-2017-5361

Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack...

SUSE CVE-2017-5943

Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery CSRF verification tokens via a crafted URL...

SUSE CVE-2017-5944

The dashboard subscription interface in Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name...

Cross-Site Scripting (XSS)

Best Practical Request Tracker is vulnerable to cross-site scripting. The vulnerability exists via a crafted content type for an attachment which allows an attacker to inject and execute arbitrary javascript...

Debian: Security Advisory (DSA-5181-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...