PT-2017-14101

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 3.2.8 Redmine versions 3.3.x prior to 3.3.5 Redmine versions 3.4.x prior to 3.4.3 Description The issue exists due to mishandled rendering of an issue list when a multi-value field contains a crafted value, leading to...

PT-2017-14100

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 3.2.8 Redmine versions 3.3.x prior to 3.3.5 Redmine versions 3.4.x prior to 3.4.3 Description The issue exists due to mishandled rendering of issue history when a multi-value field contains a crafted value, leading to...

CVE-2017-15569: Improper Neutralization of Input During Web Page Generation

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/querieshelper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list...

CVE-2017-15568: Improper Neutralization of Input During Web Page Generation

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/applicationhelper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history...

CVE-2009-4065: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the settings page in the Strongarm module 6.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the value field when viewing overridden variables...

CVE-2008-3874: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field aka Label == Value pairs. NOTE: some of these details are obtained from third party information...

CVE-2003-0181: Undefined Security Weakness

Lotus Domino Web Server nhttp.exe before 6.0.1 allows remote attackers to cause a denial of service via a "Fictionary Value Field POST request" as demonstrated using the sValidation form with a long, unknown parameter name...