CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15574
https://notcve.org/view.php?id=CVE-2017-15574
In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment. En Redmine en versiones anteriores a la 3.2.6 y 3.3.x en versiones anteriores a la 3.3.3, es posible que se realice Cross-Site Scripting (XSS) persistente empleando un documento SVG como adjunto. • https://www.debian.org/security/2018/dsa-4191 https://www.redmine.org/issues/24199 https://www.redmine.org/projects/redmine/wiki/Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15577
https://notcve.org/view.php?id=CVE-2017-15577
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information. Redmine en versiones anteriores a la 3.2.6 y 3.3.x en versiones anteriores a la 3.3.3 gestiona de manera incorrecta la presentación de enlaces wiki, lo que permite que atacantes remotos obtengan información sensible. • https://www.debian.org/security/2018/dsa-4191 https://www.redmine.org/issues/23793 https://www.redmine.org/projects/redmine/wiki/Security_Advisories • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2017-15568
https://notcve.org/view.php?id=CVE-2017-15568
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history. En Redmine en versiones anteriores a la 3.2.8, 3.3.x en versiones anteriores a la 3.3.5 y 3.4.x en versiones anteriores a la 3.4.3, existe XSS en app/helpers/application_helper.rb mediante un campo de múltiples valores con un valor manipulado que se gestiona de manera incorrecta durante la representación del historial de problemas. • https://github.com/redmine/redmine/commit/94f7cfbf990028348b9262578acbc53a94fce448 https://www.debian.org/security/2018/dsa-4191 https://www.redmine.org/issues/27186 https://www.redmine.org/projects/redmine/wiki/Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2017-15569
https://notcve.org/view.php?id=CVE-2017-15569
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list. En Redmine en versiones anteriores a la 3.2.8, 3.3.x en versiones anteriores a la 3.3.5 y 3.4.x en versiones anteriores a la 3.4.3, existe XSS en app/helpers/queries_helper.rb mediante un campo de múltiples valores con un valor manipulado que se gestiona de manera incorrecta durante la representación del historial de problemas. • https://github.com/redmine/redmine/commit/56c8ee0440d8555aa7822d947ba9091c8a791508 https://www.debian.org/security/2018/dsa-4191 https://www.redmine.org/issues/27186 https://www.redmine.org/projects/redmine/wiki/Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10515
https://notcve.org/view.php?id=CVE-2016-10515
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages. En Redmine en versiones anteriores a la 3.2.3 hay vulnerabilidades de Cross-Site Scripting (XSS) persistente que afectan al formato de texto Textile y Markdown, así como a las páginas de inicio de proyectos. • https://www.redmine.org/projects/redmine/wiki/Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •