863 matches found
CVE-2017-15570
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/list.html.erb via crafted column data...
CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
CVE-2017-15569
CVE-2017-15569 affects Redmine versions prior to 3.2.8, 3.3.x prior to 3.3.5, and 3.4.x prior to 3.4.3. The vulnerability is an XSS in app/helpers/queries_helper.rb via a multi-value field mishandled during rendering of the issue list. Exploitation details are not provided in the initial document...
CVE-2017-15568
CVE-2017-15568 affects Redmine prior to 3.2.8, 3.3.x prior to 3.3.5, and 3.4.x prior to 3.4.3. A cross-site scripting vulnerability exists in app/helpers/application_helper.rb triggered by a multi-value field during rendering of issue history. Connected sources confirm the issue and provide remed...
CVE-2017-15570
CVE-2017-15570 affects Redmine versions with known XSS in the Timelog view: 3.2.8 and earlier, 3.3.x before 3.3.5, and 3.4.x before 3.4.3. The vulnerability arises from crafted data in app/views/timelog/_list.html.erb, enabling cross-site scripting. Impact is cross-site scripting; the description...
CVE-2017-15574
CVE-2017-15574 affects Redmine before 3.2.6 and 3.3.x before 3.3.3, enabling stored XSS via an SVG attachment. The vulnerability is evidenced in multiple sources: the NVD entry and CNVD/Nessus listings confirm the SVG-based XSS in Redmine’s attachment handling. Debian security advisories (DSA-419...
CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages...
CVE-2017-15568
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/applicationhelper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history...
CVE-2017-15577
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information...
CVE-2017-15570
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/list.html.erb via crafted column data...
CVE-2017-15573
In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content...
CVE-2017-15575
In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact...
CVE-2017-15576
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information...
CVE-2015-8477
Cross-site scripting XSS vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering...
DEBIAN-CVE-2015-8477
Cross-site scripting XSS vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering...
CVE-2015-8477
Cross-site scripting XSS vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering...
Cross site scripting
Cross-site scripting XSS vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering...
CVE-2015-8477
Cross-site scripting XSS vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering...