CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10515
https://notcve.org/view.php?id=CVE-2016-10515
18 Oct 2017 — In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages. En Redmine en versiones anteriores a la 3.2.3 hay vulnerabilidades de Cross-Site Scripting (XSS) persistente que afectan al formato de texto Textile y Markdown, así como a las páginas de inicio de proyectos. • https://www.redmine.org/projects/redmine/wiki/Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2017-15568 – Debian Security Advisory 4191-1
https://notcve.org/view.php?id=CVE-2017-15568
18 Oct 2017 — In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history. En Redmine en versiones anteriores a la 3.2.8, 3.3.x en versiones anteriores a la 3.3.5 y 3.4.x en versiones anteriores a la 3.4.3, existe XSS en app/helpers/application_helper.rb mediante un campo de múltiples valores con un valor manipulado que se gestiona de manera incorrecta durante la repre... • https://github.com/redmine/redmine/commit/94f7cfbf990028348b9262578acbc53a94fce448 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2017-15569 – Debian Security Advisory 4191-1
https://notcve.org/view.php?id=CVE-2017-15569
18 Oct 2017 — In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list. En Redmine en versiones anteriores a la 3.2.8, 3.3.x en versiones anteriores a la 3.3.5 y 3.4.x en versiones anteriores a la 3.4.3, existe XSS en app/helpers/queries_helper.rb mediante un campo de múltiples valores con un valor manipulado que se gestiona de manera incorrecta durante la representació... • https://github.com/redmine/redmine/commit/56c8ee0440d8555aa7822d947ba9091c8a791508 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2017-15570 – Debian Security Advisory 4191-1
https://notcve.org/view.php?id=CVE-2017-15570
18 Oct 2017 — In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data. En Redmine en versiones anteriores a la 3.2.8, 3.3.x en versiones anteriores a la 3.3.5 y 3.4.x en versiones anteriores a la 3.4.3, existe XSS en app/views/timelog/_list.html.erb mediante datos de columna manipulados. Multiple vulnerabilities were discovered in Redmine, a project management web application. They could lead to remote code execution, information disclosu... • https://github.com/redmine/redmine/commit/1a0976417975a128b0a932ba1552c37e9414953b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2017-15571 – Debian Security Advisory 4191-1
https://notcve.org/view.php?id=CVE-2017-15571
18 Oct 2017 — In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data. En Redmine en versiones anteriores a la 3.2.8, 3.3.x en versiones anteriores a la 3.3.5 y 3.4.x en versiones anteriores a la 3.4.3, existe XSS en app/views/issues/_list.html.erb mediante datos de columna manipulados. Multiple vulnerabilities were discovered in Redmine, a project management web application. They could lead to remote code execution, information disclosure... • https://github.com/redmine/redmine/commit/273dd9cb3bcfb1e0a0b90570b3b34eafa07d67aa • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15572 – Debian Security Advisory 4191-1
https://notcve.org/view.php?id=CVE-2017-15572
18 Oct 2017 — In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect. En Redmine en versiones anteriores a la 3.2.6 y 3.3.x en versiones anteriores a la 3.3.3, atacantes remotos pueden obtener información sensible (tokens de reestablecimiento de contraseña) leyendo un registro Referer, ya que account/lost_password no emplea una redirección. Multiple vulnerabilities were discov... • https://www.debian.org/security/2018/dsa-4191 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15573 – Debian Security Advisory 4191-1
https://notcve.org/view.php?id=CVE-2017-15573
18 Oct 2017 — In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content. En Redmine en versiones anteriores a la 3.2.6 y 3.3.x en versiones anteriores a la 3.3.3, existe XSS porque se gestiona de manera incorrecta la revisión en el contenido de la wiki. Multiple vulnerabilities were discovered in Redmine, a project management web application. They could lead to remote code execution, information disclosure or cross-site scripting attacks. • https://www.debian.org/security/2018/dsa-4191 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15574 – Debian Security Advisory 4191-1
https://notcve.org/view.php?id=CVE-2017-15574
18 Oct 2017 — In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment. En Redmine en versiones anteriores a la 3.2.6 y 3.3.x en versiones anteriores a la 3.3.3, es posible que se realice Cross-Site Scripting (XSS) persistente empleando un documento SVG como adjunto. Multiple vulnerabilities were discovered in Redmine, a project management web application. They could lead to remote code execution, information disclosure or cross-site scripting attacks. • https://www.debian.org/security/2018/dsa-4191 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15575 – Debian Security Advisory 4191-1
https://notcve.org/view.php?id=CVE-2017-15575
18 Oct 2017 — In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact. En Redmine en versiones anteriores a la 3.2.6 y 3.3.x en versiones anteriores a la 3.3.3, Redmine.pm no tiene verificación para cuando el módulo Repository está habilitado en la configuración de un proyecto, lo que podría permitir que atacantes re... • https://www.debian.org/security/2018/dsa-4191 •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15576 – Debian Security Advisory 4191-1
https://notcve.org/view.php?id=CVE-2017-15576
18 Oct 2017 — Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information. Redmine en versiones anteriores a la 3.2.6 y 3.3.x en versiones anteriores a la 3.3.3 gestiona de manera incorrecta la presentación Time Entry en vistas de actividad, lo que permite que atacantes remotos obtengan información sensible. Multiple vulnerabilities were discovered in Redmine, a project management web application. They could lead to remote co... • https://www.debian.org/security/2018/dsa-4191 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •