JVN#13618065: Redmine vulnerable to cross-site scripting

Redmine contains a cross-site scripting vulnerability CWE-79 due to improper character string processing. Impact An arbitrary script may be executed on the web browser of the user who is using the product. Solution Update the Software Update the software to the latest version according to the...

CVE-2023-47260

Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails...

DEBIAN-CVE-2023-47259

Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter...

CVE-2023-47260

Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails...

UBUNTU-CVE-2023-47258

Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter...

UBUNTU-CVE-2023-47260

Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails...

PT-2023-9189 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions prior to 4.2.11 Redmine versions 5.0.x prior to 5.0.6 Description: The issue is related to a lack of protection for the web page structure in the Thumbnails component of the Redmine web application, allowing for cross-site...

Redmine Security Vulnerabilities

Redmine is a set of open source Web-based project management and defect tracking tools . The product provides features such as project management, issue tracking and role-based access control. A security vulnerability exists in Redmine versions prior to 4.2.11 and 5.0.x prior to 5.0.6, which stem...

Redmine Security Vulnerabilities

Redmine is a set of open source Web-based project management and defect tracking tools . The product provides features such as project management, issue tracking and role-based access control. A security vulnerability exists in Redmine versions prior to 4.2.11 and 5.0.x prior to 5.0.6, which stem...

PT-2023-9191 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions prior to 4.2.11 Redmine versions 5.0.x prior to 5.0.6 Description: The issue is related to a component in the Redmine web application for project and task management, specifically in the Markdown formatter. It allows for...

PT-2023-9190 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions prior to 4.2.11 Redmine versions 5.0.x prior to 5.0.6 Description: The issue is related to a lack of protection in the structure of web pages, allowing for cross-site scripting XSS attacks in the Textile formatter. This could...

CVE-2023-47260

Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails...

CVE-2023-25182

Uncontrolled search path element in the IntelR UniteR Client software for Mac before version 4.2.11 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-4190

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11...

CVE-2023-4190 Insufficient Session Expiration in admidio/admidio

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11...

Insufficient Session Expiration

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11...

Admidio Code Issue Vulnerability

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums and downloads. A code issue vulnerability exists in versions prior to Admidio 4.2.11, which stems from a lack of cache checking, resulting in an...

CakePHP 4.2.11, 4.3.11, and 4.4.10 Released

CakePHP 4.2.11, 4.3.11, and 4.4.10 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 4.2.11, 4.3.11, and 4.4.10. These releases contain a security fix for the limit and offset methods of Cake\Database\Query. If passed unfiltered request data, these methods...

Design/Logic Flaw

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure Config\App::$proxyIPs. As a workaround, do not use...

Session fixation

CodeIgniter is a PHP full-stack web framework. When an application uses 1 multiple session cookies e.g., one for user pages and one for admin pages and 2 a session handler is set to DatabaseHandler, MemcachedHandler, or RedisHandler, then if an attacker gets one session cookie e.g., one for user...