Redmine

Redmine

51 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2021-31864

  • EPSS 0.22%
  • Published 28.04.2021 07:15:07
  • Last modified 21.11.2024 06:06:22

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incoming mail handler.

5.3

CVE-2021-31865

  • EPSS 0.39%
  • Published 28.04.2021 07:15:07
  • Last modified 21.11.2024 06:06:23

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments.

5.3

CVE-2021-31866

  • EPSS 0.44%
  • Published 28.04.2021 07:15:07
  • Last modified 21.11.2024 06:06:23

Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.

9.8

CVE-2021-30164

  • EPSS 0.21%
  • Published 06.04.2021 08:15:12
  • Last modified 21.11.2024 06:03:26

Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.

7.5

CVE-2021-30163

  • EPSS 0.5%
  • Published 06.04.2021 08:15:12
  • Last modified 21.11.2024 06:03:25

Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.

5.3

CVE-2020-36308

  • EPSS 0.45%
  • Published 06.04.2021 08:15:12
  • Last modified 21.11.2024 05:29:14

Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.

6.1

CVE-2020-36307

  • EPSS 0.42%
  • Published 06.04.2021 08:15:12
  • Last modified 21.11.2024 05:29:13

Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.

6.1

CVE-2020-36306

  • EPSS 0.34%
  • Published 06.04.2021 08:15:12
  • Last modified 21.11.2024 05:29:13

Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.

5.3

CVE-2019-25026

  • EPSS 0.44%
  • Published 06.04.2021 08:15:12
  • Last modified 21.11.2024 04:39:46

Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.

6.1

CVE-2021-29274

Exploit
  • EPSS 0.32%
  • Published 29.03.2021 04:15:13
  • Last modified 21.11.2024 06:00:55

Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.