trac

17 results · Feed

• Unscored —
  CVE-2010-5108

  Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacke…

  trac trac trac Debian
  Nov 13, 2019
• High 7.5
  CVE-2009-4405

  Trac is vulnerable to improper policy checks and missing 'raw' role check in docutils

  Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."

  trac trac Debian PyPI
  Dec 23, 2009
• High 7.5
  CVE-2008-5646

  Trac vulnerable to denial of service

  Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain wiki markup."

  trac trac Debian PyPI
  Dec 17, 2008
• Medium 5.4
  CVE-2008-5647

  Trac has vulnerability in HTML sanitizer filter

  Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attack vectors.

  trac trac Debian PyPI
  Dec 17, 2008
• Medium 6.1
  CVE-2008-3328

  Trac Cross-site Scripting (XSS) vulnerability

  Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  trac trac Debian PyPI
  Jul 27, 2008
• Medium 6.1
  CVE-2008-2951

  Trac Open Redirect vulnerability

  Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.

  trac trac Debian PyPI
  Jul 27, 2008
• Medium 6.1
  CVE-2007-1405

  Trac Cross-site Scripting (XSS) vulnerability

  Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  trac trac Debian PyPI
  Mar 10, 2007
• Medium 5.3
  CVE-2007-1406

  Trac missing Content-Disposition HTTP header

  Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknown impact and remote attack vectors.

  trac trac Debian PyPI
  Mar 10, 2007
• High 7.5
  CVE-2006-5878

  Edgewall Trac Cross-site request forgery (CSRF) vulnerability

  Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

  trac trac Debian PyPI
  Nov 14, 2006
• Critical 9.4
  CVE-2006-3695

  Trac reStructuredText breach of privacy and denial of service vulnerability

  Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) …

  trac trac Debian PyPI
  Jul 19, 2006
• Unscored —
  CVE-2006-2106

  Cross-site scripting (XSS) vulnerability in Edgewall Software Trac 0.9.4 and earlier allows remote attackers to inject …

  trac Debian
  Apr 29, 2006
• Medium 6.1
  CVE-2005-4644

  Trac HTML WikiProcessor cross-site scripting (XSS) vulnerability

  Cross-site scripting (XSS) vulnerability in the HTML WikiProcessor in Edgewall Trac 0.9.2 allows remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.

  trac trac Debian PyPI
  Jan 11, 2006
• Unscored —
  CVE-2005-4305

  Cross-site scripting (XSS) vulnerability in Edgewall Trac 0.9, 0.9.1, and 0.9.2 allows remote attackers to inject arbit…

  trac Debian
  Dec 17, 2005
• Unscored —
  CVE-2005-4065 Public exploit

  SQL injection vulnerability in the search module in Edgewall Trac before 0.9.2 allows remote attackers to execute arbit…

  trac Debian
  Dec 7, 2005
• Unscored —
  CVE-2005-3980 Public exploit

  SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attacker…

  trac Debian
  Dec 4, 2005
• Unscored —
  CVE-2005-2147

  Trac before 0.8.4 allows remote attackers to read or upload arbitrary files via a full pathname in the id parameter to …

  trac Debian
  Jul 6, 2005
• Unscored —
  CVE-2005-2007

  Directory traversal vulnerability in Edgewall Trac 0.8.3 and earlier allows remote attackers to read or write arbitrary…

  trac Debian
  Jun 20, 2005