Best Practical Request Tracker (RT) prior to 5.0.3 has an Open Redirect via a ticket search.
bestpractical request tracker