CVE-2015-5475

Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.

• CWE-79

• http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.htmlPatch, Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164607.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165124.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165163.html
• http://www.debian.org/security/2015/dsa-3335
• http://www.securityfocus.com/bid/76364
• https://bestpractical.com/release-notes/rt/4.2.12Patch, Vendor Advisory
• http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.htmlPatch, Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164607.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165124.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165163.html
• http://www.debian.org/security/2015/dsa-3335
• http://www.securityfocus.com/bid/76364
• https://bestpractical.com/release-notes/rt/4.2.12Patch, Vendor Advisory

Published

Aug 14, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5469Absolute path traversal vulnerability in the MDC YouTube Dow…
• CVE-2015-5470The label decompression functionality in PowerDNS Recursor b…
• CVE-2015-5471Absolute path traversal vulnerability in include/user/downlo…
• CVE-2015-5472Absolute path traversal vulnerability in lib/download.php in…
• CVE-2015-5473Multiple directory traversal vulnerabilities in Samsung Sync…
• CVE-2015-5474BitTorrent and uTorrent allow remote attackers to inject com…
• CVE-2015-5477named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10…
• CVE-2015-5479The ff_h263_decode_mba function in libavcodec/ituh263dec.c i…
• CVE-2015-5481Cross-site scripting (XSS) vulnerability in forms/panels.php…
• CVE-2015-5482Directory traversal vulnerability in the GD bbPress Attachme…
• CVE-2015-5483Multiple cross-site request forgery (CSRF) vulnerabilities i…8.8
• CVE-2015-5484Cross-site scripting (XSS) vulnerability in the Plotly plugi…5.4