CVE-2015-1464

CVE-2015-1464 concerns Request Tracker (RT) session hijacking via an RSS feed URL. The vulnerability affects RT where RSS feed URLs could be exploited to log in as the user who created the feed. Affected are RT 4.0.x before 4.0.23 and RT 4.2.x before 4.2.10. Public advisories (Fedora, Debian) ind...

CVE-2015-1165

CVE-2015-1165 affects RT (Request Tracker) 3.8.8 through RT 4.x up to 4.0.23 and 4.2.x up to 4.2.10, enabling remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors. The connected advisories/documents indicate multiple vendors released security updates to addre...

CVE-2015-1165

RT aka Request Tracker 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors...

DLA-158-1 request-tracker3.8 - security update

Bulletin has no description...

CVE-2013-3737

The MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13, when using the file-based session store Apache::Session::File and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and cache...

Design/Logic Flaw

The MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13, when using the file-based session store Apache::Session::File and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and cache...

CVE-2013-3737

The CVE-2013-3737 issue affects the MobileUI (RT-Extension-MobileUI) for Request Tracker (RT) installations. It concerns MobileUI >=?

CVE-2013-3737

The MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13, when using the file-based session store Apache::Session::File and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and cache...

Request Tracker 4.2.x < 4.2.5 Email::Address:List Module String Handling DoS

According to its self-reported version number, the Best Practical Solutions Request Tracker RT running on the remote web server is version 4.2.x prior to 4.2.5. It is, therefore, potentially affected by a denial of service vulnerability due to an algorithmic complexity flaw in the Perl CPAN...

Request Tracker (RT) 4.2.x - 4.2.2 DoS Vulnerability

Request Tracker RT is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2013-3736

Cross-site scripting XSS vulnerability in the MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file...

Cross site scripting

Cross-site scripting XSS vulnerability in the MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file...

CVE-2013-3736

Cross-site scripting XSS vulnerability in the MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file...

CVE-2013-3736

Cross-site scripting XSS vulnerability in the MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file...

CVE-2013-3369

Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors...

CVE-2013-3370

Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request...

DEBIAN-CVE-2013-3370

Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request...

CVE-2013-5587

Cross-site scripting XSS vulnerability in Request Tracker RT 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions...

CVE-2013-3373

CRLF injection vulnerability in Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header...

DEBIAN-CVE-2013-3371

Cross-site scripting XSS vulnerability in Request Tracker RT 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment...