RSS   Podatności dla 'Redmine'   RSS

2021-10-12
 
CVE-2021-42326

CWE-200
 
 
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.

 
2021-08-05
 
CVE-2021-37156

CWE-613
 
 
Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.

 
2021-04-06
 
CVE-2021-30164

NVD-CWE-noinfo
 
 
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.

 
 
CVE-2021-30163

CWE-200
 
 
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.

 
 
CVE-2020-36308

CWE-74
 
 
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.

 
 
CVE-2020-36307

CWE-79
 
 
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.

 
 
CVE-2020-36306

CWE-79
 
 
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.

 
 
CVE-2019-25026

NVD-CWE-noinfo
 
 
Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.

 
2021-03-29
 
CVE-2021-29274

CWE-79
 
 
Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.

 
2019-11-21
 
CVE-2019-18890

CWE-89
 
 
A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.

 

Copyright 2024, cxsecurity.com

 

Back to Top