Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.
Max CVSS
7.5
EPSS Score
0.09%
Published
2023-11-03
Updated
2023-11-13
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.
Max CVSS
7.5
EPSS Score
0.06%
Published
2023-11-03
Updated
2023-11-13
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.
Max CVSS
7.5
EPSS Score
0.06%
Published
2023-11-03
Updated
2023-11-13
Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.
Max CVSS
6.1
EPSS Score
0.07%
Published
2022-07-14
Updated
2022-07-20
Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment.
Max CVSS
6.1
EPSS Score
0.08%
Published
2022-07-14
Updated
2022-07-20
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools.
Max CVSS
9.1
EPSS Score
0.13%
Published
2022-07-14
Updated
2022-07-20
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
Max CVSS
9.1
EPSS Score
0.13%
Published
2022-07-14
Updated
2022-07-21
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
Max CVSS
7.5
EPSS Score
0.28%
Published
2021-10-18
Updated
2023-01-20
The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.
Max CVSS
7.5
EPSS Score
1.23%
Published
2019-03-21
Updated
2023-01-20
The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.
Max CVSS
8.8
EPSS Score
1.21%
Published
2017-07-03
Updated
2019-10-03
Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL.
Max CVSS
8.8
EPSS Score
0.20%
Published
2017-07-03
Updated
2017-07-07
Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.
Max CVSS
5.9
EPSS Score
0.26%
Published
2017-07-03
Updated
2019-10-03
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.
Max CVSS
6.1
EPSS Score
0.11%
Published
2017-07-03
Updated
2017-07-07
Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key.
Max CVSS
4.3
EPSS Score
0.28%
Published
2015-09-03
Updated
2016-12-22
Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.
Max CVSS
4.3
EPSS Score
0.28%
Published
2015-08-14
Updated
2016-12-22
RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
Max CVSS
6.4
EPSS Score
0.36%
Published
2015-03-09
Updated
2015-10-28
RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
Max CVSS
5.0
EPSS Score
0.39%
Published
2015-03-09
Updated
2015-10-28
The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to cause a denial of service (CPU and disk consumption) via a crafted email.
Max CVSS
7.1
EPSS Score
1.42%
Published
2015-03-09
Updated
2016-08-23
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.
Max CVSS
5.0
EPSS Score
0.66%
Published
2014-07-15
Updated
2014-07-15
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.
Max CVSS
2.6
EPSS Score
0.17%
Published
2013-08-23
Updated
2013-08-26
The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and caches via unspecified vectors.
Max CVSS
5.0
EPSS Score
0.33%
Published
2014-11-16
Updated
2015-02-10
Cross-site scripting (XSS) vulnerability in the MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file.
Max CVSS
4.3
EPSS Score
0.22%
Published
2014-05-05
Updated
2017-08-29
SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims.
Max CVSS
7.5
EPSS Score
0.74%
Published
2013-05-10
Updated
2024-03-21
Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."
Max CVSS
4.3
EPSS Score
0.31%
Published
2013-08-23
Updated
2013-08-26
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.
Max CVSS
5.0
EPSS Score
0.49%
Published
2013-08-23
Updated
2013-08-26
62 vulnerabilities found
1 2 3
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!