CVE-2015-8537

app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed...

Open redirect

Open redirect vulnerability in the validbackurl function in app/controllers/applicationcontroller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted backurl parameter, a...

Information disclosure

app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed...

UBUNTU-CVE-2015-8346

app/views/timelog/form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form...

UBUNTU-CVE-2015-8537

app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed...

CVE-2015-8346

app/views/timelog/form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form...

CVE-2015-8537

app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed...

CVE-2015-8473

The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects...

CVE-2015-8473

Redmine's CVE-2015-8473 affects the Issues API: before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2, remote authenticated users could read changeset messages and obtain sensitive information from related changesets in other projects due to insufficient access checks. The issue is a informati...

CVE-2015-8473

The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects...

CVE-2015-8474

Open redirect vulnerability in the validbackurl function in app/controllers/applicationcontroller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted backurl parameter, a...

CVE-2015-8346

app/views/timelog/form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form...

CVE-2015-8346

app/views/timelog/form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form...

CVE-2015-8474

Open redirect vulnerability in the validbackurl function in app/controllers/applicationcontroller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted backurl parameter, a...

CVE-2015-8537

app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed...

CVE-2015-8346

CVE-2015-8346 affects Redmine, where rendering the timelog form in versions prior to 2.6.8 (and 3.0.x prior to 3.0.6, and 3.1.x prior to 3.1.2) allows remote attackers to obtain sensitive information about subjects of issues. The issue is a information disclosure through the time-logging form. Re...

CVE-2015-8474

CVE-2015-8474 is an open redirect vulnerability in Redmine's valid_back_url function (app/controllers/application_controller.rb). The issue affects Redmine releases prior to: 2.6.7, 3.0.x prior to 3.0.5, and 3.1.x prior to 3.1.1. An attacker can craft a back_url parameter to redirect victims to a...

CVE-2015-8537

CVE-2015-8537 : Redmine versions prior to 2.6.9, 3.0.x prior to 3.0.7, and 3.1.x prior to 3.1.3 expose sensitive information through viewing an Atom feed. Root cause is information disclosure via Atom feed handling. Remediation per sources: upgrade to fixed Redmine releases (e.g., Debian advisory...

Redmine Atom Feed Information Disclosure Vulnerability

Redmine is a set of open source Web-based project management and defect tracking tools . A security vulnerability exists in Redmine versions prior to 2.6.9. An attacker can exploit the vulnerability to obtain sensitive information...

Debian DSA-3529-1 : redmine - security update

Multiple vulnerabilities have been found in Redmine, a project management web application, which may result in information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3529...