Filtered by vendor Redmine
Subscriptions
Filtered by product Redmine
Subscriptions
Total
50 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2017-18026 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536. | ||||
| CVE-2017-16804 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users to obtain sensitive information by reading e-mail reminder messages. | ||||
| CVE-2017-15574 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment. | ||||
| CVE-2017-15573 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content. | ||||
| CVE-2017-15570 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data. | ||||
| CVE-2017-15571 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data. | ||||
| CVE-2017-15577 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information. | ||||
| CVE-2017-15576 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information. | ||||
| CVE-2017-15575 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact. | ||||
| CVE-2017-15572 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect. | ||||
| CVE-2017-15569 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list. | ||||
| CVE-2017-15568 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | N/A |
| In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history. | ||||
| CVE-2019-25026 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | 5.3 Medium |
| Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting. | ||||
| CVE-2019-18890 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-05 | 6.5 Medium |
| A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query. | ||||
| CVE-2019-17427 | 1 Redmine | 1 Redmine | 2024-08-05 | 6.1 Medium |
| In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. | ||||
| CVE-2020-36306 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-04 | 6.1 Medium |
| Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field. | ||||
| CVE-2020-36308 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-04 | 5.3 Medium |
| Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries. | ||||
| CVE-2020-36307 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-04 | 6.1 Medium |
| Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links. | ||||
| CVE-2021-42326 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-08-04 | 5.3 Medium |
| Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter. | ||||
| CVE-2021-37156 | 1 Redmine | 1 Redmine | 2024-08-04 | 7.5 High |
| Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated. | ||||