Search
Search Results (47 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-36308 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-11-21 | 5.3 Medium |
| Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries. | ||||
| CVE-2020-36307 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-11-21 | 6.1 Medium |
| Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links. | ||||
| CVE-2020-36306 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-11-21 | 6.1 Medium |
| Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field. | ||||
| CVE-2019-25026 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-11-21 | 5.3 Medium |
| Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting. | ||||
| CVE-2019-18890 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-11-21 | 6.5 Medium |
| A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query. | ||||
| CVE-2019-17427 | 1 Redmine | 1 Redmine | 2024-11-21 | 6.1 Medium |
| In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. | ||||
| CVE-2017-18026 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2024-11-21 | N/A |
| Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536. | ||||