CVE-2011-1686

CVE-2011-1686 concerns multiple SQL injection vulnerabilities in Best Practical Solutions RT across RT 2.0.0–3.6.10, 3.8.0–3.8.9, and 4.0.0rc–4.0.0rc7, allowing remote authenticated users to run arbitrary SQL via unspecified vectors (data reading demonstrated). Concrete references in connected do...

CVE-2011-1689

CVE-2011-1689 affects Best Practical Solutions RT (2.x–4.0.0rc7), with multiple XSS vulnerabilities allowing remote script injection via unspecified vectors. Public sources confirm RT is vulnerable across listed versions; Debian advisory notes fixes in RT 3.8.x branch (e.g., 3.8.8–7+squeeze1, 3.8...

CVE-2011-1685

Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources aka external custom field option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery CSRF...

CVE-2011-1690

Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 through 3.8.8 allows remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors...

CVE-2011-1689

Multiple cross-site scripting XSS vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-1690

Summary: CVE-2011-1690 affects Best Practical Solutions RT (Request Tracker) 3.6.0–3.6.10 and 3.8.0–3.8.8. It enables remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors (no exploit details provided in the sources). The vulnerability is categori...

CVE-2011-1688

Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request...

CVE-2011-1687

CVE-2011-1687 affects Best Practical Solutions RT (Request Tracker). The vulnerability allows remote authenticated users to obtain sensitive information by using the search interface, demonstrated by retrieving encrypted passwords. Affected RT versions include 3.0.0–3.6.10, 3.8.0–3.8.9, and 4.0.0...

CVE-2011-1688

Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request...

CVE-2011-1689

Multiple cross-site scripting XSS vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-1686

Multiple SQL injection vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors, as demonstrated by reading data...

PT-2011-3292

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 3.8.0 through 3.8.9 Best Practical Solutions RT versions 4.0.0rc through 4.0.0rc7 Description The issue allows remote authenticated users to execute arbitrary code via unspecified vectors when the...

PT-2011-3296

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 2.0.0 through 3.6.10 Best Practical Solutions RT versions 3.8.0 through 3.8.9 Best Practical Solutions RT versions 4.0.0rc through 4.0.0rc7 Description The issue allows remote attackers to inject arbitrary...

PT-2011-3294

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 3.0.0 through 3.6.10 Best Practical Solutions RT versions 3.8.0 through 3.8.9 Best Practical Solutions RT versions 4.0.0rc through 4.0.0rc7 Description The issue allows remote authenticated users to obtain...

PT-2011-3293

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 2.0.0 through 3.6.10 Best Practical Solutions RT versions 3.8.0 through 3.8.9 Best Practical Solutions RT versions 4.0.0rc through 4.0.0rc7 Description The issue allows remote authenticated users to execute...

PT-2011-3297

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 3.6.0 through 3.6.10 Best Practical Solutions RT versions 3.8.0 through 3.8.8 Description The issue allows remote attackers to trick users into sending credentials to an arbitrary server. Recommendations Fo...

PT-2011-3295

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 3.2.0 through 3.6.10 Best Practical Solutions RT versions 3.8.0 through 3.8.9 Best Practical Solutions RT versions 4.0.0rc through 4.0.0rc7 Description The issue allows remote attackers to read arbitrary...

CVE-2011-1689: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-1688: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request...

rt -- multiple vulnerabilities

Best Practical reports: In the process of preparing the release of RT 4.0.0, we performed an extensive security audit of RT's source code. During this audit, several vulnerabilities were found which affect earlier releases of RT...