https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 21:45:30 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-105456 <p>RTIR extends RT&#39;s HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR&#39;s own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user&#39;s session, and can act in RT with that user&#39;s authority.</p> <p>This issue was fixed in version 5.0.11 and 6.0.4</p> <p>RTIR extends RT&#39;s HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR&#39;s own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user&#39;s session, and can act in RT with that user&#39;s authority.</p> <p>This issue was fixed in version 5.0.11 and 6.0.4</p> https://db.gcve.eu/vuln/fkie_cve-2026-105456 https://db.gcve.eu/vuln/ghsa-pg4w-4q6c-jvpm <p>RTIR extends RT&#39;s HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR&#39;s own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user&#39;s session, and can act in RT with that user&#39;s authority.</p> <p>This issue was fixed in version 5.0.11 and 6.0.4</p> <p>RTIR extends RT&#39;s HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR&#39;s own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user&#39;s session, and can act in RT with that user&#39;s authority.</p> <p>This issue was fixed in version 5.0.11 and 6.0.4</p> https://db.gcve.eu/vuln/ghsa-pg4w-4q6c-jvpm