RE
Product
Redmine
51
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 29Low 0
Watch
Add Redmine to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-18026 | 8.8 | Jan 10 | Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to… Affected: before 3.2.9; 3.3.0 before 3.3.6; 3.4.0 before 3.4.4 |
| CVE-2022-44030 | 7.5 | Dec 6 | Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks Affected: 5.0.0 through 5.0.3 |
| CVE-2021-37156 | 7.5 | Aug 5 | Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to… Affected: 4.2.0; 4.2.1 |
| CVE-2021-31863 | 7.5 | Apr 28 | Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local… Affected: before 4.0.9; 4.1.0 before 4.1.3; 4.2.0 before 4.2.1 |
| CVE-2021-30163 | 7.5 | Apr 6 | Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values Affected: before 4.0.8; 4.1.0 before 4.1.2 |
| CVE-2017-15577 | 7.5 | Oct 18 | Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information Affected: through 3.2.5; 3.3.0; 3.3.1; 3.3.2 |
| CVE-2017-15576 | 7.5 | Oct 18 | Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information Affected: through 3.2.5; 3.3.0; 3.3.1; 3.3.2 |
| CVE-2017-15572 | 7.5 | Oct 18 | In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password… Affected: through 3.2.5; 3.3.0; 3.3.1; 3.3.2 |
| CVE-2015-8474 | 7.4 | Apr 12 | Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows… Affected: through 2.6.6; 2.5.1; 3.0.0; 3.0.1; 3.0.2; 3.0.3; +2 more |
| CVE-2017-15575 | 7.3 | Oct 18 | In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers… Affected: through 3.2.5; 3.3.0; 3.3.1; 3.3.2 |
Showing 10