CVE-2014-6276

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details...

CVE-2014-6276

The CVE-2014-6276 entry corresponds to Roundup (web-based issue tracker) and affects versions before 1.5.1. The root cause is that schema.py does not properly restrict attributes in default user permissions, enabling remote authenticated users to view sensitive user details. Observed impact inclu...

Debian Security Advisory DSA 3502-1 (roundup - security update)

Ralf Schlatterbeck discovered an information leak in roundup, a web-based issue tracking system. An authenticated attacker could use it to see sensitive details about other users, including their hashed password. After applying the update, which will fix the shipped templates, the site...

Debian: Security Advisory (DSA-3502-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Roundup Information Disclosure Vulnerability

Roundup is a command line, web and email issue tracking system. The system provides bug tracking, customer help desk and issue management. An information disclosure vulnerability exists in Roundup. An attacker could exploit this vulnerability to obtain sensitive information about other users...

Debian DSA-3502-1 : roundup - security update

Ralf Schlatterbeck discovered an information leak in roundup, a web-based issue tracking system. An authenticated attacker could use it to see sensitive details about other users, including their hashed password. After applying the update, which will fix the shipped templates, the site...

[SECURITY] [DSA 3502-1] roundup security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3502-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez March 03, 2016 https://www.debian.org/security/faq -...

Debian DLA-298-1 : roundup security update

CVE-2012-6130 Cross-site scripting XSS vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link. - CVE-2012-6131 Cross-site scripting XSS vulnerability in cgi/client.py in Roundup...

[SECURITY] [DLA 298-1] roundup security update

Package : roundup Version : 1.4.15-3+deb6u1 CVE ID : CVE-2012-6130 CVE-2012-6131 CVE-2012-6132 CVE-2012-6133 CVE-2012-6130 Cross-site scripting XSS vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related ...

DLA-298-1 roundup - security update

Bulletin has no description...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the integrity of protected information

The multiple vulnerabilities in the Debian GNU/Linux operating system’s roundup package can be exploited, leading to a breach of the integrity of protected information. These vulnerabilities can be exploited remotely...

Roundup 0.5/0.6 - Remote File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10495/info Roundup is prone to a remote file disclosure vulnerability. A remote user can disclose files on a vulnerable computer by using the /home/@@file/ prefix and '../' directory traversal sequences. This vulnerabilit...

CVE-2012-6131

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

CVE-2012-6130

Cross-site scripting XSS vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link...

CVE-2012-6130

Cross-site scripting XSS vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link...

Cross site scripting

Cross-site scripting XSS vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link...

PYSEC-2014-15

Cross-site scripting XSS vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link...

PYSEC-2014-16

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

PYSEC-2014-16

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

PYSEC-2014-15

Cross-site scripting XSS vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link...