CVE-2017-15571

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/list.html.erb via crafted column data...

CVE-2017-15573

In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content...

CVE-2017-15568

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/applicationhelper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history...

CVE-2017-15572

Vulnerability overview (CVE-2017-15572): Redmine before 3.2.6 and 3.3.x before 3.3.3 exposes password reset tokens via an information disclosure in the account/lost_password flow, because the redirect is not used and Referer logs can leak tokens. Affected software: Redmine web application; vulner...

CVE-2017-15575

CVE-2017-15575 affects Redmine prior to 3.2.6 and 3.3.x prior to 3.3.3. Root cause: Redmine.pm does not verify if the Repository module is enabled in a project’s settings, allowing remote attackers to obtain sensitive diff information (and possibly other impact). Impact: information disclosure. M...

CVE-2017-15576

CVE-2017-15576 affects Redmine before 3.2.6 and 3.3.x before 3.3.3. The issue arises from mishandling Time Entry rendering in activity views, enabling remote disclosure of sensitive information. The vulnerability is labeled as information disclosure with CVSSv3 base score 7.5 (NETWORK, LOW attack...

CVE-2017-15571

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/list.html.erb via crafted column data...

CVE-2017-15574

In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment...

CVE-2017-15572

In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information password reset tokens by reading a Referer log, because account/lostpassword does not use a redirect...

CVE-2017-15577

Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information...

CVE-2017-15573

CVE-2017-15573 affects Redmine before 3.2.6 and 3.3.x before 3.3.3. The flaw is an XSS in wiki content caused by mishandling of markup in wiki pages. In practice, an attacker can inject scripts via wiki content (e.g., attachments with SVG) to execute in a victim's browser. The connected sources i...

CVE-2017-15577

Redmine (community project management app) versions affected: 3.2.x up to 3.2.5 and 3.3.x up to 3.3.2 (CVE-2017-15577). The issue arises from how wiki links are rendered, allowing remote attackers to obtain sensitive information. The vulnerability is documented across multiple advisories, e.g., D...

CVE-2016-10515

CVE-2016-10515 affects Redmine prior to 3.2.3, with stored XSS in Textile and Markdown text formatting and project homepages. The root cause is stored cross-site scripting in user-supplied formatting that can be persisted in pages rendered by Redmine. Affected software is Redmine (versions before...

CVE-2017-15572

In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information password reset tokens by reading a Referer log, because account/lostpassword does not use a redirect...

CVE-2017-15574

In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment...

CVE-2017-15569

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/querieshelper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list...

CVE-2017-15574

CVE-2017-15574 affects Redmine before 3.2.6 and 3.3.x before 3.3.3, enabling stored XSS via an SVG attachment. The vulnerability is evidenced in multiple sources: the NVD entry and CNVD/Nessus listings confirm the SVG-based XSS in Redmine’s attachment handling. Debian security advisories (DSA-419...

CVE-2017-15576

Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information...

CVE-2017-15575

In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact...

CVE-2017-15569

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/querieshelper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list...