Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
57 results · page 1 of 2
Jun 12, 2026The system stores the username and password from the login form after submitting the request.CVE-2026-1836 · Other software · Redmine · reported by cve-coordination@incibe.esMedium 5.3
The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands throuCVE-2020-37105 · Other software · redmine · reported by VulnCheckHigh 7.1
PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can leverage this vulnerability by sending crafted requests to the /admin/sauvegarde/download.php endpoint with manipulated logid values to interact with the database.
- Product
- PMB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforge.sigb.netsigb.net
Apr 28, 2025A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic.CVE-2025-4011 · Other software · reported by VulDBMedium 5.1
A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 6.0.4 is able to address this issue. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2024Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4.CVE-2024-36267 · Other software · Kontron · reported by vultures@jpcert.or.jpHigh 8.1
Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4. If this vulnerability is exploited, a logged-in user may obtain or delete arbitrary files on the server (within the privilege of the Redmine process).
- Product
- Redmine DMSF Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2023Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails.CVE-2023-47260 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Nov 5, 2023Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter.CVE-2023-47259 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Nov 5, 2023Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.CVE-2023-47258 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Jun 13, 2023A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrCVE-2023-31541 · Other software · Ckeditor · reported by MITRECritical 9.8
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.
- Product
- Ckeditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2022Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields.CVE-2022-44637 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Dec 11, 2022Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formCVE-2022-44031 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Dec 6, 2022Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks.CVE-2022-44030 · Other software · Redmine · reported by MITREHigh 7.5
Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Oct 12, 2021Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.CVE-2021-42326 · Other software · Redmine · reported by MITREMedium 5.3
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Aug 5, 2021Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is foCVE-2021-37156 · Other software · Redmine · reported by MITREHigh 7.5
Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Apr 28, 2021Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comCVE-2021-31866 · Other software · Redmine · reported by MITREMedium 5.3
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 28, 2021Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments.CVE-2021-31865 · Other software · Redmine · reported by MITREMedium 5.3
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 28, 2021Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incominCVE-2021-31864 · Other software · Redmine · reported by MITREMedium 5.3
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incoming mail handler.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 28, 2021Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to readCVE-2021-31863 · Other software · Redmine · reported by MITREHigh 7.5
Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 6, 2021Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.CVE-2021-30164 · Other software · Redmine · reported by MITRECritical 9.8
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 6, 2021Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to projeCVE-2021-30163 · Other software · Redmine · reported by MITREHigh 7.5
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 6, 2021Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.CVE-2020-36308 · Other software · Redmine · reported by MITREMedium 5.3
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 6, 2021Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.CVE-2020-36307 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 6, 2021Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.CVE-2020-36306 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 6, 2021Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.CVE-2019-25026 · Other software · Redmine · reported by MITREMedium 5.3
Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Mar 29, 2021Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.CVE-2021-29274 · Other software · Redmine · reported by MITREMedium 6.1
Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Nov 21, 2019A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.CVE-2019-18890 · Other software · Redmine · reported by MITREMedium 6.5
A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Oct 9, 2019In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.CVE-2019-17427 · Other software · Redmine · reported by MITREMedium 6.1
In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Sep 16, 2019The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data.CVE-2019-15950 · Other software · Redmineup · reported by MITREMedium 6.1
The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comredmineup.com
Jan 10, 2018Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remoCVE-2017-18026 · Other software · Redmine · reported by MITREHigh 8.8
Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2017In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote aCVE-2017-16804 · Other software · Redmine · reported by MITREMedium 4.3
In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users to obtain sensitive information by reading e-mail reminder messages.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.CVE-2017-15577 · Other software · Redmine · reported by MITREHigh 7.5
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.CVE-2017-15576 · Other software · Redmine · reported by MITREHigh 7.5
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allowCVE-2017-15575 · Other software · Redmine · reported by MITREHigh 7.3
In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment.CVE-2017-15574 · Other software · Redmine · reported by MITREMedium 6.1
In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content.CVE-2017-15573 · Other software · Redmine · reported by MITREMedium 6.1
In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because accoCVE-2017-15572 · Other software · Redmine · reported by MITREHigh 7.5
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data.CVE-2017-15571 · Other software · Redmine · reported by MITREMedium 6.1
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.CVE-2017-15570 · Other software · Redmine · reported by MITREMedium 6.1
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value thCVE-2017-15569 · Other software · Redmine · reported by MITREMedium 6.1
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted valuCVE-2017-15568 · Other software · Redmine · reported by MITREMedium 6.1
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages.CVE-2016-10515 · Other software · Redmine · reported by MITREMedium 6.1
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
May 23, 2017Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash messCVE-2015-8477 · Other software · Redmine · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Apr 12, 2016app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by CVE-2015-8537 · Other software · Debian · reported by MITREMedium 5.3
app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2016Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x bCVE-2015-8474 · Other software · Debian · reported by MITREHigh 7.4
Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back_url parameter, as demonstrated by "@attacker.com," a different vulnerability than CVE-2014-1985.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2016The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeseCVE-2015-8473 · Other software · Debian · reported by MITREMedium 4.3
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Apr 12, 2016app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information aboCVE-2015-8346 · Other software · Redmine · reported by MITREMedium 5.3
app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2014git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the sCVE-2013-4663 · Other software · Redmine · reported by MITREHigh 7.5
git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs, related to the get_info_refs function or (2) the reqfile argument to the file_exists function.
- Product
- Redmine GIT Hosting Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2014Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1CVE-2014-1985 · Other software · Redmine · reported by vultures@jpcert.or.jpMedium 5.8
Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter).
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2012Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unkCVE-2011-4929 · Other software · Redmine · reported by Red HatHigh 7.5
Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgopenwall.com
Oct 8, 2012Cross-site scripting (XSS) vulnerability in the textile formatter in Redmine before 1.0.5 allows remote attackers to inject arbitrary web script or HTML via unsCVE-2011-4928 · Other software · Redmine · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the textile formatter in Redmine before 1.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgopenwall.com
Oct 8, 2012Unspecified vulnerability in the bazaar repository adapter in Redmine 1.0.x before 1.0.5 allows remote authenticated users to obtain sensitive information via uCVE-2011-4927 · Other software · Redmine · reported by Red HatMedium 4
Unspecified vulnerability in the bazaar repository adapter in Redmine 1.0.x before 1.0.5 allows remote authenticated users to obtain sensitive information via unknown vectors.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.