48 results · Feed
-
Medium 5.3
Stored credentials in Redmine
The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.
-
Low 3.5
Redmine Custom Query cross site scripting
A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can…
-
Unscored —
Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter.
-
Unscored —
Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.
-
Unscored —
Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails.
-
Medium 6.1
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization…
-
Medium 6.1
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization…
-
High 7.5
Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permi…
-
Unscored —
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient ac…
-
Unscored —
Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x …
-
Unscored —
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permiss…
-
Unscored —
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extens…
-
Unscored —
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by o…
-
Unscored —
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal…
-
Unscored —
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.
-
Unscored —
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.
-
Unscored —
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performi…
-
Unscored —
Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.
-
Unscored —
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by le…
-
Unscored —CVE-2019-18890 Public exploit
A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected…
-
Unscored —CVE-2019-17427 Public exploit
In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.
-
Unscored —
Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to th…
-
Unscored —
In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether a…
-
Unscored —
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and proje…
-
Unscored —
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset token…
-
Unscored —
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote atta…
-
Unscored —
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to ob…
-
Unscored —
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via …
-
Unscored —
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb vi…
-
Unscored —
In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment.
-
Unscored —
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a …
-
Unscored —
In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled i…
-
Unscored —
In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content.
-
Unscored —
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script…
-
Unscored —
app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote atta…
-
Unscored —
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to…
-
Unscored —
app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote atta…
-
Unscored —
Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine befo…
-
Unscored —
Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Re…