Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

bestpractical request tracker 3.8.15 vulnerabilities and exploits

(subscribe to this query)
7.5
CVSSv2
CVE-2013-3525
SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and previous versions allows remote malicious users to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and th...
Bestpractical Request Tracker 3.8.15Bestpractical Request Tracker 4.0.0Bestpractical Request Tracker 4.0.6Bestpractical Request Tracker 4.0.7Bestpractical Request Tracker 3.8.16Bestpractical Request Tracker 4.0.5Bestpractical Request Tracker 3.8.7Bestpractical Request Tracker 3.6.8Bestpractical Request Tracker 4.0.1Bestpractical Request Tracker 4.0.2Bestpractical Request TrackerBestpractical Request Tracker 4.0.4Bestpractical Request Tracker 3.8.14Bestpractical Request Tracker 3.6.10Bestpractical Request Tracker 3.8.9Bestpractical Request Tracker 3.8.10Bestpractical Request Tracker 3.8.13Bestpractical Request Tracker 3.8.11Bestpractical Request Tracker 3.8.12Bestpractical Request Tracker 4.0.8Bestpractical Request Tracker 4.0.3Bestpractical Request Tracker 3.8.4
5
CVSSv2
CVE-2015-1165
RT (aka Request Tracker) 3.8.8 up to and including 4.x prior to 4.0.23 and 4.2.x prior to 4.2.10 allows remote malicious users to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
Debian Debian Linux 7.0Fedoraproject Fedora 21Fedoraproject Fedora 22Bestpractical Request Tracker 4.0.1Bestpractical Request Tracker 4.0.2Bestpractical Request Tracker 4.0.3Bestpractical Request Tracker 4.0.4Bestpractical Request Tracker 4.0.18Bestpractical Request Tracker 4.0.19Bestpractical Request Tracker 3.8.11Bestpractical Request Tracker 3.8.12Bestpractical Request Tracker 3.8.13Bestpractical Request Tracker 3.8.14Bestpractical Request Tracker 4.0.9Bestpractical Request Tracker 4.0.10Bestpractical Request Tracker 4.0.11Bestpractical Request Tracker 4.0.12Bestpractical Request Tracker 4.0.13Bestpractical Request Tracker 4.2.3Bestpractical Request Tracker 4.2.4Bestpractical Request Tracker 4.2.5Bestpractical Request Tracker 4.2.6
7.1
CVSSv2
CVE-2014-9472
The email gateway in RT (aka Request Tracker) 3.0.0 up to and including 4.x prior to 4.0.23 and 4.2.x prior to 4.2.10 allows remote malicious users to cause a denial of service (CPU and disk consumption) via a crafted email.
Debian Debian Linux 7.0Fedoraproject Fedora 22Fedoraproject Fedora 21Bestpractical Request Tracker 3.8.16Bestpractical Request Tracker 3.8.17Bestpractical Request Tracker 4.0.0Bestpractical Request Tracker 4.0.1Bestpractical Request Tracker 4.0.14Bestpractical Request Tracker 4.0.15Bestpractical Request Tracker 4.0.16Bestpractical Request Tracker 4.0.17Bestpractical Request Tracker 4.0.18Bestpractical Request Tracker 4.2.8Bestpractical Request Tracker 4.2.9Bestpractical Request Tracker 3.6.10Bestpractical Request Tracker 3.8.3Bestpractical Request Tracker 3.8.13Bestpractical Request Tracker 3.8.15Bestpractical Request Tracker 4.0.2Bestpractical Request Tracker 4.0.4Bestpractical Request Tracker 4.0.11Bestpractical Request Tracker 4.0.13
4.3
CVSSv2
CVE-2012-6578
Best Practical Solutions RT 3.8.x prior to 3.8.15 and 4.0.x prior to 4.0.8, when GnuPG is enabled with a "Sign by default" queue configuration, uses a queue's key for signing, which might allow remote malicious users to spoof messages by leveraging the lack of auth...
Bestpractical Request Tracker 3.8.7Bestpractical Request Tracker 3.8.9Bestpractical Request Tracker 3.8.10Bestpractical Request Tracker 3.8.11Bestpractical Request Tracker 3.8.4Bestpractical Request Tracker 3.8.12Bestpractical Request Tracker 3.8.14Bestpractical Request Tracker 3.8.3Bestpractical Request Tracker 3.8.13Bestpractical Request Tracker 4.0.4Bestpractical Request Tracker 4.0.6Bestpractical Request Tracker 4.0.1Bestpractical Request Tracker 4.0.0Bestpractical Request Tracker 4.0.3Bestpractical Request Tracker 4.0.2Bestpractical Request Tracker 4.0.5Bestpractical Request Tracker 4.0.7
6.4
CVSSv2
CVE-2012-6579
Best Practical Solutions RT 3.8.x prior to 3.8.15 and 4.0.x prior to 4.0.8, when GnuPG is enabled, allows remote malicious users to configure encryption or signing for certain outbound e-mail, and possibly cause a denial of service (loss of e-mail readability), via an e-mail mess...
Bestpractical Request Tracker 3.8.9Bestpractical Request Tracker 3.8.10Bestpractical Request Tracker 3.8.11Bestpractical Request Tracker 3.8.12Bestpractical Request Tracker 3.8.13Bestpractical Request Tracker 3.8.3Bestpractical Request Tracker 3.8.7Bestpractical Request Tracker 3.8.4Bestpractical Request Tracker 3.8.14Bestpractical Request Tracker 4.0.0Bestpractical Request Tracker 4.0.7Bestpractical Request Tracker 4.0.3Bestpractical Request Tracker 4.0.2Bestpractical Request Tracker 4.0.5Bestpractical Request Tracker 4.0.4Bestpractical Request Tracker 4.0.1Bestpractical Request Tracker 4.0.6
4.3
CVSSv2
CVE-2012-6581
Best Practical Solutions RT 3.8.x prior to 3.8.15 and 4.0.x prior to 4.0.8, when GnuPG is enabled, allows remote malicious users to bypass intended restrictions on reading keys in the product's keyring, and trigger outbound e-mail messages signed by an arbitrary stored secre...
Bestpractical Request Tracker 3.8.3Bestpractical Request Tracker 3.8.4Bestpractical Request Tracker 3.8.7Bestpractical Request Tracker 3.8.10Bestpractical Request Tracker 3.8.12Bestpractical Request Tracker 3.8.13Bestpractical Request Tracker 3.8.14Bestpractical Request Tracker 3.8.9Bestpractical Request Tracker 3.8.11Bestpractical Request Tracker 4.0.5Bestpractical Request Tracker 4.0.4Bestpractical Request Tracker 4.0.7Bestpractical Request Tracker 4.0.6Bestpractical Request Tracker 4.0.0Bestpractical Request Tracker 4.0.2Bestpractical Request Tracker 4.0.1Bestpractical Request Tracker 4.0.3
4.3
CVSSv2
CVE-2012-6580
Best Practical Solutions RT 3.8.x prior to 3.8.15 and 4.0.x prior to 4.0.8, when GnuPG is enabled, does not ensure that the UI labels unencrypted messages as unencrypted, which might make it easier for remote malicious users to spoof details of a message's origin or interfer...
Bestpractical Request Tracker 3.8.3Bestpractical Request Tracker 3.8.4Bestpractical Request Tracker 3.8.7Bestpractical Request Tracker 3.8.9Bestpractical Request Tracker 3.8.11Bestpractical Request Tracker 3.8.13Bestpractical Request Tracker 3.8.14Bestpractical Request Tracker 3.8.10Bestpractical Request Tracker 3.8.12Bestpractical Request Tracker 4.0.6Bestpractical Request Tracker 4.0.3Bestpractical Request Tracker 4.0.5Bestpractical Request Tracker 4.0.7Bestpractical Request Tracker 4.0.1Bestpractical Request Tracker 4.0.0Bestpractical Request Tracker 4.0.2Bestpractical Request Tracker 4.0.4
6.8
CVSSv2
CVE-2013-3370
Request Tracker (RT) 3.8.x prior to 3.8.17 and 4.0.x prior to 4.0.13 does not properly restrict access to private callback components, which allows remote malicious users to have an unspecified impact via a direct request.
Bestpractical Rt 4.0.9Bestpractical Rt 4.0.0Bestpractical Rt 4.0.3Bestpractical Rt 4.0.8Bestpractical Rt 4.0.12Bestpractical Rt 4.0.11Bestpractical Rt 4.0.1Bestpractical Rt 4.0.2Bestpractical Rt 4.0.5Bestpractical Rt 4.0.6Bestpractical Rt 4.0.7Bestpractical Rt 4.0.10Bestpractical Rt 4.0.4Bestpractical Rt 3.8.0Bestpractical Rt 3.8.1Bestpractical Rt 3.8.10Bestpractical Rt 3.8.13Bestpractical Rt 3.8.14Bestpractical Rt 3.8.3Bestpractical Rt 3.8.4Bestpractical Rt 3.8.7Bestpractical Rt 3.8.8
6
CVSSv2
CVE-2013-3369
Request Tracker (RT) 3.8.x prior to 3.8.17 and 4.0.x prior to 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors.
Bestpractical Rt 3.8.0Bestpractical Rt 3.8.1Bestpractical Rt 3.8.13Bestpractical Rt 3.8.14Bestpractical Rt 3.8.7Bestpractical Rt 3.8.8Bestpractical Rt 3.8.16Bestpractical Rt 3.8.11Bestpractical Rt 3.8.12Bestpractical Rt 3.8.2Bestpractical Rt 3.8.6Bestpractical Rt 3.8.9Bestpractical Rt 3.8.10Bestpractical Rt 3.8.3Bestpractical Rt 3.8.4Bestpractical Rt 3.8.15Bestpractical Rt 3.8.5Bestpractical Rt 4.0.0Bestpractical Rt 4.0.5Bestpractical Rt 4.0.6Bestpractical Rt 4.0.7Bestpractical Rt 4.0.9
4.3
CVSSv2
CVE-2013-3371
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 up to and including 3.8.16 and 4.0.x prior to 4.0.13 allows remote malicious users to inject arbitrary web script or HTML via the filename of an attachment.
Bestpractical Rt 3.8.0Bestpractical Rt 3.8.1Bestpractical Rt 3.8.11Bestpractical Rt 3.8.15Bestpractical Rt 3.8.2Bestpractical Rt 3.8.4Bestpractical Rt 3.8.5Bestpractical Rt 3.8.6Bestpractical Rt 3.8.8Bestpractical Rt 3.8.9Bestpractical Rt 3.8.13Bestpractical Rt 3.8.10Bestpractical Rt 3.8.3Bestpractical Rt 3.8.14Bestpractical Rt 3.8.7Bestpractical Rt 3.8.16Bestpractical Rt 3.8.12Bestpractical Rt 4.0.10Bestpractical Rt 4.0.0Bestpractical Rt 4.0.1Bestpractical Rt 4.0.2Bestpractical Rt 4.0.3
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook