CVE-2012-4731

CVE-2012-4731 affects Request Tracker’s FAQ manager (RTFM) prior to version 2.4.5, where inadequate verification of user rights allows remote authenticated users to create arbitrary articles in arbitrary classes via unknown vectors. The issue is documented across multiple sources (NVD entry and r...

CVE-2012-4734

Request Tracker (RT) vulnerable versions: 3.8.x before 3.8.15 and 4.0.x before 4.0.8. Description: a remote attacker can bypass the CSRF warning via a crafted link to cause victims to modify arbitrary state (confused deputy). The sources confirm affected ranges and attack surface; exploitation sp...

CVE-2012-4731

FAQ manager for Request Tracker RTFM before 2.4.5 does not properly check user rights, which allows remote authenticated users to create arbitrary articles in arbitrary classes via unknown vectors...

CVE-2012-4732

Vulnerability (CVE-2012-4732) : A cross-site request forgery (CSRF) in Request Tracker (RT) versions 3.8.12 and earlier than 3.8.15, and 4.0.6 and earlier than 4.0.8, lets remote attackers hijack user authentication to perform actions that toggle ticket bookmarks. Affected product: Request Tracke...

CVE-2012-4730

Request Tracker RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors...

CVE-2012-4734

Request Tracker RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link...

CVE-2012-4731

FAQ manager for Request Tracker RTFM before 2.4.5 does not properly check user rights, which allows remote authenticated users to create arbitrary articles in arbitrary classes via unknown vectors...

CVE-2012-4732

Cross-site request forgery CSRF vulnerability in Request Tracker RT 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks...

CVE-2012-4884

Argument injection vulnerability in Request Tracker RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors related to the GnuPG client...

CVE-2012-4730

CVE-2012-4730 affects Best Practical Solutions’ Request Tracker (RT), specifically versions 3.8.x before 3.8.15 and 4.0.x before 4.0.8. The public description in the connected sources states that remote authenticated users who have ModifySelf or AdminUser privileges can inject arbitrary email hea...

CVE-2012-4884

Argument injection vulnerability in Request Tracker RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors related to the GnuPG client...

CVE-2012-4730

Request Tracker RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors...

CVE-2012-4732

Cross-site request forgery CSRF vulnerability in Request Tracker RT 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks...

CVE-2012-4734

Request Tracker RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link...

CVE-2012-4884

CVE-2012-4884 concerns Request Tracker (RT). The issue is an argument injection vulnerability in RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, related to the GnuPG client, which allows remote attackers to create arbitrary files via unspecified vectors. Affected software is the Best Practical Sol...

[SECURITY] [DSA 2567-1] request-tracker3.8 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2567-1 [email protected] http://www.debian.org/security/ Florian Weimer October 26, 2012 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2567-1 (request-tracker3.8)

The remote host is missing an update to request-tracker3.8 announced via advisory DSA 2567-1. OpenVAS Vulnerability Test $Id: deb25671.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2567-1 request-tracker3.8 Authors: Thomas Reinke Copyright: Copyright c 20...

Debian: Security Advisory (DSA-2567-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2567-1 : request-tracker3.8 - several vulnerabilities

Several vulnerabilities were discovered in Request Tracker RT, an issue tracking system. - CVE-2012-4730 Authenticated users can add arbitrary headers or content to mail generated by RT. - CVE-2012-4732 A CSRF vulnerability may allow attackers to toggle ticket bookmarks. - CVE-2012-4734 If users...

[SECURITY] [DSA 2568-1] rtfm security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2568-1 [email protected] http://www.debian.org/security/ Florian Weimer October 26, 2012 http://www.debian.org/security/faq -...