1003 matches found
CVE-2019-17427
CVE-2019-17427 CVE-2019-17427 Persistent XSS POC In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. The vulnerability essentially exists on any wiki page which by default uses textile formatting. You can take advantage of it by using pre...
CVE-2019-18890
CVE-2019-18890 CVE-2019-18890 POC Proof of Concept REDMINE UP TO 3.2.9/3.3.9 SQL INJECTION https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Requirements: Access credentials Subproject is required REST API is enabled On Mysql the first query on which injection occurs looks like the example below wi...
Redmine Issues - Exposure Detection
Redmine instance exposed issues via the REST API without authentication. This could have leaked sensitive project information, issue details, and user data. !/usr/bin/env python3 -- coding: utf-8 -- """Redmine instance exposed issues via the REST API without authentication.""" from kittysploit...
Redmine settings.yml File Disclosure Detection
Detects Redmine settings.yml File Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Redmine settings.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Redmine settings.yml File Disclosure Detection',...
CVE-2026-1836
CVE-2026-1836 affects Redmine where the system stores the username and password from the login form after submission. This could allow an attacker with access to the platform to return to the browser and view credentials, compromising confidentiality (high impact). Root cause described as credent...
CVE-2026-1836 Stored credentials in Redmine
The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials...
CVE-2026-1836 Stored credentials in Redmine
The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials...
CVE-2023-31541
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server...
CVE-2021-31864
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the addissuenotes permission requirement by leveraging the incoming mail handler...
CVE-2021-31866
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController...
CVE-2021-31863
Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process...
CVE-2021-31865
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments...
CVE-2019-18890
A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query...
EUVD-2012-2060
Malware in sbrugna...
EUVD-2009-4426
Malware in sbrugna...
EUVD-2009-4050
Malware in sbrugna...
EUVD-2011-4837
Malware in sbrugna...
EUVD-2009-4049
Malware in sbrugna...