High WID-SEC-2025-0899 3 CVEs

Redmine.org Redmine: Mehrere Schwachstellen

Published Apr 28, 2025 · Updated Apr 28, 2025 · de-DE

Vendor: Redmine Product: Redmine Platform: Linux Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Redmine.org Redmine ausnutzen, um Informationen offenzulegen, einen Cross-Site Scripting Angriff durchzuführen und weitere, nicht spezifizierte Auswirkungen zu verursachen.

Product

Redmine ist eine Web-basierte Projektmanagement Anwendung, die in Ruby on Rails geschrieben ist.

Vulnerabilities 3

High 7.8

CVE-2024-56171

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleI…

xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine Wolfi

Feb 18, 2025
High 7.8

CVE-2025-24928

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To…

xmlsoft libxml2 qt6-qtwebengine libxml2 Debian Ubuntu Azure Linux Alpine Wolfi

Feb 18, 2025
Low 3.5

CVE-2025-4011

Redmine Custom Query cross site scripting

A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can…

redmine redmine Debian Ubuntu

Apr 28, 2025

Revision history

2025-04-28 #1
Initiale Fassung

References

Redmine Security Advisories vom 2025-04-28
https://www.redmine.org/projects/redmine/wiki/Security_Advisories
Redine Releasenotes vom 2025-04-28
https://www.redmineadvisor.com/articles/6_0/redmine-6_0_4-released/