Lucene search

K
BestpracticalRt3.8.8

9 matches found

CVE
CVE
added 2011/01/25 7:0 p.m.55 views

CVE-2011-0009

Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier for context-dependent attackers to determine cleartext passwords via a brute-force attack on the database.

4.3CVSS6.3AI score0.00834EPSS
CVE
CVE
added 2011/04/22 10:55 a.m.50 views

CVE-2011-1689

Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.6AI score0.00557EPSS
CVE
CVE
added 2011/04/22 10:55 a.m.47 views

CVE-2011-1686

Multiple SQL injection vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors, as demonstrated by reading data.

6.5CVSS8AI score0.0092EPSS
CVE
CVE
added 2011/04/22 10:55 a.m.47 views

CVE-2011-1687

Best Practical Solutions RT 3.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote authenticated users to obtain sensitive information by using the search interface, as demonstrated by retrieving encrypted passwords.

4CVSS5.7AI score0.00497EPSS
CVE
CVE
added 2011/02/28 4:0 p.m.45 views

CVE-2011-1007

Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.

2.1CVSS6.5AI score0.00106EPSS
CVE
CVE
added 2011/04/22 10:55 a.m.45 views

CVE-2011-1688

Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request.

4.3CVSS6.4AI score0.00358EPSS
CVE
CVE
added 2011/04/22 10:55 a.m.44 views

CVE-2011-1685

Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) ...

4.6CVSS7.4AI score0.00925EPSS
CVE
CVE
added 2011/04/22 10:55 a.m.40 views

CVE-2011-1690

Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 through 3.8.8 allows remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors.

4.3CVSS6.7AI score0.0082EPSS
CVE
CVE
added 2011/02/28 4:0 p.m.28 views

CVE-2011-1008

Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, r...

4CVSS6.3AI score0.0061EPSS