865 matches found
Design/Logic Flaw
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries...
UBUNTU-CVE-2021-30164
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the addissuenotes permission requirement by leveraging the Issues API...
UBUNTU-CVE-2021-30163
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to projectid values...
UBUNTU-CVE-2019-25026
Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting...
UBUNTU-CVE-2020-36307
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...
CVE-2020-36308
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries...
CVE-2021-30164
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the addissuenotes permission requirement by leveraging the Issues API...
CVE-2021-30163
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to projectid values...
Design/Logic Flaw
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to projectid values...
CVE-2021-30163
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to projectid values...
UBUNTU-CVE-2020-36308
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries...
CVE-2021-30164
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the addissuenotes permission requirement by leveraging the Issues API...
Cross site scripting
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...
Design/Logic Flaw
Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting...
Authentication flaw
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the addissuenotes permission requirement by leveraging the Issues API...
CVE-2019-25026
Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting...
UBUNTU-CVE-2020-36306
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...
CVE-2021-30163
CVE-2021-30163 is an information disclosure vulnerability in Redmine: older Redmine versions (before 4.0.8 and 4.1.x before 4.1.2) can allow an attacker to discover the names of private projects when issue journals contain changes to project_id values. Remediations vary by release: Debian LTS adv...
