Затронутые ветки версий
Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2026-44230 | RT: Reflected Cross-Site Scripting in search results chart | * | 6.1 | — | 2026-07-21 | |
| CVE-2026-44231 | RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint | * | 9.1 | — | 2026-07-21 | |
| CVE-2026-44229 | RT: Cross-Site Scripting via inline-served uploaded content | * | 5.4 | — | 2026-07-21 | |
| CVE-2026-44228 | RT: Stored Cross-Site Scripting via insufficient template escaping | * | 5.4 | — | 2026-07-21 | |
| CVE-2026-44227 | RT: Reflected Cross-Site Scripting via URL parameters | * | 6.1 | — | 2026-07-21 | |
| CVE-2026-41076 | RT: LDAP authentication bypass via empty password | * | 8.1 | — | 2026-05-23 | |
| CVE-2026-41075 | RT: SQL injection via entry_aggregator parameter in JSON search | * | 8.8 | — | 2026-05-23 | |
| CVE-2026-41074 | RT has broken CSRF protection for authenticated users | * | 7.1 | — | 2026-05-23 | |
| CVE-2026-41073 | RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps | * | 4.6 | — | 2026-05-23 | |
| CVE-2026-6841 | Reflected XSS in Request Tracker | ≥ 5.0.4 < 5.0.10 ≥ 6.0.0 < 6.0.3 | 5.1 | — | 2026-05-21 | |
| CVE-2025-31501 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink. | ≥ 5.0.0 < 5.0.8 | 7.2 | — | 2025-05-28 | |
| CVE-2025-31500 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name. | ≥ 5.0.0 < 5.0.8 | 7.2 | — | 2025-05-28 | |
| CVE-2025-30087 | Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafte... | ≥ 4.4.0 < 4.4.8 ≥ 5.0.0 < 5.0.8 | 7.2 | — | 2025-05-28 | |
| CVE-2021-38562 | Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive... | * | — | — | 2021-10-18 | |
| CVE-2015-6506 | Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 a... | * | — | — | 2015-09-03 | |
| CVE-2011-1007 | Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows... | * | — | — | 2011-03-01 | |
| CVE-2011-1008 | Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj... | * | — | — | 2011-03-01 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).