16 matches found
CVE-2019-18890
CVE-2019-18890 CVE-2019-18890 POC Proof of Concept REDMINE UP TO 3.2.9/3.3.9 SQL INJECTION https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Requirements: Access credentials Subproject is required REST API is enabled On Mysql the first query on which injection occurs looks like the example below wi...
CVE-2026-23625
OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work...
CVE-2026-23625
OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work...
CVE-2026-23625 OpenProject has stored XSS regression using attachments and script-src self
OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work...
EUVD-2026-3309
OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work...
CVE-2026-23625 OpenProject has stored XSS regression using attachments and script-src self
OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work...
CVE-2026-23625 OpenProject has stored XSS regression using attachments and script-src self
OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work...
CVE-2026-23625
OpenProject CVE-2026-23625 affects versions 16.3.0–16.6.4. A stored XSS in the Roadmap view occurs when a version’s work packages include a subproject; the helper link_to_work_package renders package.project.to_s with html_safe, allowing HTML in subproject names to be injected. The issue is mitig...
[SECURITY] Fedora 42 Update: gi-docgen-2025.5-1.fc42
GI-DocGen is a document generator for GObject-based libraries. GObject is the base type system of the GNOME project. GI-Docgen reuses the introspection data generated by GObject-based libraries to generate the API reference of these libraries, as well as other ancillary documentation. GI-DocGen i...
PT-2025-12711
Name of the Vulnerable Software and Affected Versions OpenDaylight Service Function Chaining SFC Subproject versions Sodium-SR4 and below Description The issue is related to insecure Shiro cookie configurations, which can be exploited by attackers to access sensitive information via a...
CVE-2025-29314: Missing Encryption of Sensitive Data
Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining SFC Subproject SFC Sodium-SR4 and below allow attackers to access sensitive information via a man-in-the-middle attack...
CVE-2025-29313: Improper Resource Shutdown or Release
Use of incorrectly resolved name or reference in OpenDaylight Service Function Chaining SFC Subproject SFC Sodium-SR4 and below allows attackers to cause a Denial of Service DoS...
PT-2025-12710
Name of the Vulnerable Software and Affected Versions OpenDaylight Service Function Chaining SFC Subproject versions Sodium-SR4 and below Description The issue is related to the use of incorrectly resolved names or references, which can lead to a Denial of Service DoS. This allows attackers to...
CVE-2024-42472 Flatpak may allow access to files outside sandbox for certain apps
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...
