CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Redmine » Redmine » * * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-31866 203 2021-04-28 2021-06-01
5.0
None Remote Low Not required Partial None None
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.
2 CVE-2021-31865 863 2021-04-28 2021-06-01
5.0
None Remote Low Not required None Partial None
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments.
3 CVE-2021-31864 863 Bypass 2021-04-28 2021-06-01
5.0
None Remote Low Not required None Partial None
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incoming mail handler.
4 CVE-2021-31863 20 2021-04-28 2021-06-01
5.0
None Remote Low Not required Partial None None
Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process.
5 CVE-2021-30164 Bypass 2021-04-06 2021-06-02
7.5
None Remote Low Not required Partial Partial Partial
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.
6 CVE-2021-30163 200 +Info 2021-04-06 2021-06-03
5.0
None Remote Low Not required Partial None None
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.
7 CVE-2021-29274 79 XSS 2021-03-29 2021-03-30
4.3
None Remote Medium Not required None Partial None
Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.
8 CVE-2020-36308 74 2021-04-06 2021-06-01
5.0
None Remote Low Not required Partial None None
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.
9 CVE-2020-36307 79 XSS 2021-04-06 2021-06-01
4.3
None Remote Medium Not required None Partial None
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.
10 CVE-2020-36306 79 XSS 2021-04-06 2021-06-01
4.3
None Remote Medium Not required None Partial None
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.
11 CVE-2019-25026 2021-04-06 2021-06-01
5.0
None Remote Low Not required None Partial None
Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.
12 CVE-2019-18890 89 Sql 2019-11-21 2019-11-26
4.0
None Remote Low ??? Partial None None
A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.
13 CVE-2019-17427 79 XSS 2019-10-10 2019-11-19
4.3
None Remote Medium Not required None Partial None
In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.
14 CVE-2017-18026 Exec Code 2018-01-10 2019-10-03
6.8
None Remote Medium Not required Partial Partial Partial
Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536.
15 CVE-2017-16804 200 +Info 2017-11-13 2019-04-30
4.0
None Remote Low ??? Partial None None
In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users to obtain sensitive information by reading e-mail reminder messages.
16 CVE-2017-15577 200 +Info 2017-10-18 2019-03-14
5.0
None Remote Low Not required Partial None None
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.
17 CVE-2017-15576 200 +Info 2017-10-18 2019-03-14
5.0
None Remote Low Not required Partial None None
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
18 CVE-2017-15575 +Info 2017-10-18 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.
19 CVE-2017-15574 79 XSS 2017-10-18 2019-03-14
4.3
None Remote Medium Not required None Partial None
In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment.
20 CVE-2017-15573 79 XSS 2017-10-18 2019-03-14
4.3
None Remote Medium Not required None Partial None
In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content.
21 CVE-2017-15572 532 +Info 2017-10-18 2019-03-14
5.0
None Remote Low Not required Partial None None
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
22 CVE-2017-15571 79 XSS 2017-10-18 2019-03-14
4.3
None Remote Medium Not required None Partial None
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data.
23 CVE-2017-15570 79 XSS 2017-10-18 2019-03-14
4.3
None Remote Medium Not required None Partial None
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.
24 CVE-2017-15569 79 XSS 2017-10-18 2019-03-14
4.3
None Remote Medium Not required None Partial None
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list.
25 CVE-2017-15568 79 XSS 2017-10-18 2019-03-14
4.3
None Remote Medium Not required None Partial None
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history.
26 CVE-2016-10515 79 XSS 2017-10-18 2017-10-25
4.3
None Remote Medium Not required None Partial None
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages.
27 CVE-2015-8537 200 +Info 2016-04-12 2016-04-20
5.0
None Remote Low Not required Partial None None
app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.
28 CVE-2015-8477 79 XSS 2017-05-23 2017-05-31
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
29 CVE-2015-8474 2016-04-12 2016-04-20
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back_url parameter, as demonstrated by "@attacker.com," a different vulnerability than CVE-2014-1985.
30 CVE-2015-8473 200 +Info 2016-04-12 2016-04-20
4.0
None Remote Low ??? Partial None None
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
31 CVE-2015-8346 199 +Info 2016-04-12 2016-04-20
5.0
None Remote Low Not required Partial None None
app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.
32 CVE-2014-1985 20 2014-04-11 2017-12-16
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter).
33 CVE-2012-2054 255 2012-04-05 2012-04-05
5.0
None Remote Low Not required None Partial None
Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8) Version, (9) Wiki, (10) UserPreference, or (11) Board model via a modified URL, related to a "mass assignment" vulnerability, a different vulnerability than CVE-2012-0327.
34 CVE-2012-0327 79 XSS 2012-04-05 2012-10-30
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
35 CVE-2011-4928 79 XSS 2012-10-08 2012-10-09
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the textile formatter in Redmine before 1.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
36 CVE-2009-4459 79 1 XSS 2009-12-30 2017-08-17
4.3
None Remote Medium Not required None Partial None
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.
37 CVE-2009-4079 352 CSRF 2009-11-25 2017-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Redmine 0.8.5 and earlier allows remote attackers to hijack the authentication of users for requests that delete a ticket via unspecified vectors.
38 CVE-2009-4078 79 XSS 2009-11-25 2017-08-17
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Redmine 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
39 CVE-2008-4481 79 XSS 2008-10-08 2017-08-08
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Redmine 0.7.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Total number of vulnerabilities : 39   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.