RE
Product
Redmine
51
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 29Low 0
Watch
Add Redmine to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-18890 | 6.5 | Nov 21 | A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query Affected: before 3.3.10 |
| CVE-2023-47260 | 6.1 | Nov 5 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails Affected: before 4.2.11; 5.0.0 before 5.0.6 |
| CVE-2023-47259 | 6.1 | Nov 5 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter Affected: before 4.2.11; 5.0.0 before 5.0.6 |
| CVE-2023-47258 | 6.1 | Nov 5 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter Affected: before 4.2.11; 5.0.0 before 5.0.6 |
| CVE-2022-44637 | 6.1 | Dec 12 | Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields Affected: before 4.2.9; 5.0.0 before 5.0.4 |
| CVE-2022-44031 | 6.1 | Dec 12 | Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields Affected: before 4.2.9; 5.0.0 before 5.0.4 |
| CVE-2020-36307 | 6.1 | Apr 6 | Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links Affected: before 4.0.7; 4.1.0 before 4.1.1 |
| CVE-2020-36306 | 6.1 | Apr 6 | Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field Affected: before 4.0.7; 4.1.0 before 4.1.1 |
| CVE-2021-29274 | 6.1 | Mar 29 | Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip Affected: 4.1.0 before 4.1.2 |
| CVE-2019-17427 | 6.1 | Oct 10 | In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors Affected: before 3.4.11; 4.0.0 before 4.0.4 |
| CVE-2017-15574 | 6.1 | Oct 18 | In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment Affected: through 3.2.5; 3.3.0; 3.3.1; 3.3.2 |
| CVE-2017-15573 | 6.1 | Oct 18 | In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content Affected: through 3.2.5; 3.3.0; 3.3.1; 3.3.2 |
| CVE-2017-15571 | 6.1 | Oct 18 | In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data Affected: through 3.2.7; 3.3.0; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +3 more |
| CVE-2017-15570 | 6.1 | Oct 18 | In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data Affected: through 3.2.7; 3.3.0; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +3 more |
| CVE-2017-15569 | 6.1 | Oct 18 | In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled… Affected: through 3.2.7; 3.3.0; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +3 more |
| CVE-2017-15568 | 6.1 | Oct 18 | In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is… Affected: through 3.2.7; 3.3.0; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +3 more |
| CVE-2016-10515 | 6.1 | Oct 18 | In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages Affected: through 3.2.2 |
| CVE-2015-8477 | 6.1 | May 23 | Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering Affected: through 2.6.1 |
| CVE-2026-1836 | 5.3 | Jun 12 | Stored credentials in Redmine Affected: before 6.0.7; before 5.1.10; before 5.0.14 |
| CVE-2021-42326 | 5.3 | Oct 12 | Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter Affected: before 4.1.5; 4.2.0 before 4.2.3 |
| CVE-2021-31866 | 5.3 | Apr 28 | Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations… Affected: before 4.0.9; 4.1.0 before 4.1.3 |
| CVE-2021-31865 | 5.3 | Apr 28 | Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments Affected: before 4.0.9; 4.1.0 before 4.1.3; 4.2.0 before 4.2.1 |
| CVE-2021-31864 | 5.3 | Apr 28 | Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incoming mail handler Affected: before 4.0.9; 4.1.0 before 4.1.3; 4.2.0 before 4.2.1 |
| CVE-2020-36308 | 5.3 | Apr 6 | Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries Affected: before 4.0.7; 4.1.0 before 4.1.1 |
| CVE-2019-25026 | 5.3 | Apr 6 | Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting Affected: before 3.4.13; 4.0.0 before 4.0.6 |
| CVE-2015-8537 | 5.3 | Apr 12 | app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom… Affected: through 2.6.8; 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +5 more |
| CVE-2015-8346 | 5.3 | Apr 12 | app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of… Affected: through 2.6.7; 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +3 more |
| CVE-2017-16804 | 4.3 | Nov 13 | In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users… Affected: before 3.2.7; 3.3.0; 3.3.1; 3.3.2; 3.3.3 |
| CVE-2015-8473 | 4.3 | Apr 12 | The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by… Affected: through 2.6.7; 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +3 more |
Showing 29