Vulnerabilities for Redmine (...) - CXSECURITY.COM

Vulnerabilities for 'Redmine'

2021-10-12

CVE-2021-42326

CWE-200

Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.

2021-08-05

CVE-2021-37156

CWE-613

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.

2021-04-06

CVE-2021-30164

NVD-CWE-noinfo

Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.

CVE-2021-30163

CWE-200

Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.

CVE-2020-36308

CWE-74

Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.

CVE-2020-36307

CWE-79

Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.

CVE-2020-36306

CWE-79

Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.

CVE-2019-25026

NVD-CWE-noinfo

Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.

2021-03-29

CVE-2021-29274

CWE-79

Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.

2019-11-21

CVE-2019-18890

CWE-89

A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.

Copyright 2024, cxsecurity.com