CVE-2013-3368

The CVE-2013-3368 entry concerns RT (Request Tracker) where bin/rt in RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name. Connected documents reiterate this exact description across multip...

CVE-2013-3370

CVE-2013-3370 affects Request Tracker (RT) 3.8.x prior to 3.8.17 and 4.0.x prior to 4.0.13. The flaw is failure to properly restrict access to private callback components, allowing remote attackers to trigger an unspecified impact via a direct request. The connected documents consistently describ...

CVE-2012-4733

CVE-2012-4733 affects Request Tracker (RT) 4.x prior to 4.0.13. The issue is an improper enforcement of the DeleteTicket and “custom lifecycle transition” permissions, allowing remote authenticated users who have the ModifyTicket permission to delete tickets via unspecified vectors. The connected...

CVE-2013-3369

CVE-2013-3369 affects Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13. The flaw allows remote authenticated users who have permission to view administration pages to execute arbitrary private components via unspecified vectors. The available connected sources corroborate the affe...

CVE-2012-4733

Request Tracker RT 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors...

CVE-2013-3371

Cross-site scripting XSS vulnerability in Request Tracker RT 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment...

CVE-2013-3369: Undefined Security Weakness

Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors...

PT-2013-4326

Name of the Vulnerable Software and Affected Versions Request Tracker RT versions 3.8.x through 3.8.16 Request Tracker RT versions 4.0.x through 4.0.12 Description The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name. This is...

PT-2013-4330

Name of the Vulnerable Software and Affected Versions Request Tracker RT versions 3.8.x through 3.8.16 Request Tracker RT versions 4.0.x through 4.0.12 Description The issue allows remote attackers to inject multiple Content-Disposition HTTP headers, which could lead to cross-site scripting XSS...

PT-2013-4327

Name of the Vulnerable Software and Affected Versions Request Tracker RT versions 3.8.x through 3.8.16 Request Tracker RT versions 4.0.x through 4.0.12 Description The issue allows remote authenticated users with administration page view permissions to execute arbitrary private components...

CVE-2013-3368: Improper Link Resolution Before File Access

bin/rt in Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name...

CVE-2012-4733: Undefined Security Weakness

Request Tracker RT 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors...

CVE-2013-3370: Undefined Security Weakness

Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request...

ai.platon.pulsar:pulsar-persist (>=1.9.0, <=1.10.23), com.argonio.gora:gora-accumulo (>=0.5, <=0.5.1) +167 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.5.0, <=2.5.9)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.5.0, =1.9.0, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.6.1, =1.0.0, =1.0.5 - net.stickycode.composite:sticky-composite-cxf-soap-http 1.1 - net.stickycode.ws:sticky-ws-cxf-guice3 2.2 - net.stickycode.ws:sticky-ws-cxf-spring30 2.1 and more...

ai.mattmann.mnemosyne:pcs-services (1.11.0), com.alibaba:dubbo (>=2.3.0, <=2.5.3) +153 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.6.0, <=2.6.6)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.6.0, =2.3.0, =1.0.3, =1.0.m1, =1.0.m1, =1.0.m2, =1.0.0, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2012-5575 Source advisory: MEND:CVE-2012-5575...

br.com.esec.icpm:certillion-client-library (>=1.1.7, <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9, <=1.1.10) +121 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.7.0, <=2.7.3)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.7.0, =1.1.7, =1.1.9, =1.2.5, =0.4.0, =0.4.1, =1.3.1, =1.2.3, =1.2.3, =1.4.0, =1.4.0, =1.4.0, =1.5.0 and more Source cves: CVE-2012-5575 Source advisory: MEND:CVE-2012-5575...

ai.platon.pulsar:pulsar-persist (>=1.9.0, <=1.10.23), com.argonio.gora:gora-accumulo (>=0.5, <=0.5.1) +65 more potentially affected by CVE-2013-2160 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.5.0, <=2.5.9)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.5.0, =1.9.0, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.6.1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.8 and more Source cves: CVE-2013-2160 Source advisory: MEND:CVE-2013-2160...

ai.mattmann.mnemosyne:pcs-services (1.11.0), com.apitrary:apitrary-api-client (0.1) +91 more potentially affected by CVE-2013-2160 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.6.0, <=2.6.6)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.6.0, =1.0.3, =1.0.m1, =1.0.m1, =1.0.m2, =1.0.0, =1.0.0, =1.0.0, =0.3.0, =0.3.2 and more Source cves: CVE-2013-2160 Source advisory: MEND:CVE-2013-2160...

com.sap.odata:com.sap.core.odata.core (>=0.4.0, <=0.5.0), com.sap.odata:com.sap.core.odata.processor.core (>=0.4.1, <=0.5.0) +96 more potentially affected by CVE-2013-2160 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.7.0, <=2.7.3)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.7.0, =0.4.0, =0.4.1, =1.3.1, =1.2.3, =1.2.3, =1.4.0, =1.4.0, =2.7.0, =2.7.0, =2.7.0, =2.7.3 and more Source cves: CVE-2013-2160 Source advisory: MEND:CVE-2013-2160...

CVE-2013-3175

CVE-2013-3175 is a Windows elevation-of-privilege issue in the handling of asynchronous RPC requests. Affected products include Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT. Root cause...