EUVD-2023-51391

Malicious code in bioql PyPI...

Directory Traversal

Overview redmine-mcp-server is a Production-ready MCP server for Redmine with security, pagination, and enterprise features Affected versions of this package are vulnerable to Directory Traversal via the MCP endpoint. An attacker can gain an access to restricted files by passing a specially craft...

Linux Distros Unpatched Vulnerability : CVE-2025-4011

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom...

Linux Distros Unpatched Vulnerability : CVE-2021-31864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the addissuenotes permission requirement by leveraging the incoming...

Linux Distros Unpatched Vulnerability : CVE-2021-31863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read...

Linux Distros Unpatched Vulnerability : CVE-2020-36307

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links. CVE-2020-36307 Note that Nessus relies on the presence of the package as...

Linux Distros Unpatched Vulnerability : CVE-2021-37156

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is fo...

Linux Distros Unpatched Vulnerability : CVE-2017-15576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information...

Linux Distros Unpatched Vulnerability : CVE-2023-47259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter. CVE-2023-47259 Note that Nessus relies on the presence of the package as...

Linux Distros Unpatched Vulnerability : CVE-2017-15570

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/list.html.erb via crafted column data. CVE-2017-15570 Note...

Linux Distros Unpatched Vulnerability : CVE-2023-47258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter. CVE-2023-47258 Note that Nessus relies on the presence of the package as report...

Linux Distros Unpatched Vulnerability : CVE-2021-30163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to...

Linux Distros Unpatched Vulnerability : CVE-2017-15575

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow...

Linux Distros Unpatched Vulnerability : CVE-2017-16804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote...

Linux Distros Unpatched Vulnerability : CVE-2020-36308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries...

Linux Distros Unpatched Vulnerability : CVE-2020-36306

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field. CVE-2020-36306 Note that Nessus relies on the presence of the package as reported by...

Linux Distros Unpatched Vulnerability : CVE-2022-44637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields...

Linux Distros Unpatched Vulnerability : CVE-2021-42326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter. CVE-2021-42326 Note that...

Linux Distros Unpatched Vulnerability : CVE-2021-30164

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the addissuenotes permission requirement by leveraging the Issues API. CVE-2021-30164 Not...

Linux Distros Unpatched Vulnerability : CVE-2022-44031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in...