RE
Vendor
Redmine
53
CVEs
0
On KEV
0
New 30D
Products
RE9.8
Redmine
Redmine
51 CVEs0 on KEV0 new
PM7.1
PMB
redmine
1 CVEs0 on KEV0 new
RG–
Redmine Git Hosting Plugin
Redmine
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-1836 | RE Redmine Redmine | 5.3 | Jun 12 | Stored credentials in Redmine |
| CVE-2020-37105 | PM PMB redmine | 7.1 | Feb 3 | PMB 5.6 - 'logid' SQL Injection |
| CVE-2023-47260 | RE Redmine Redmine | 6.1 | Nov 5 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails |
| CVE-2023-47259 | RE Redmine Redmine | 6.1 | Nov 5 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter |
| CVE-2023-47258 | RE Redmine Redmine | 6.1 | Nov 5 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter |
| CVE-2022-44637 | RE Redmine Redmine | 6.1 | Dec 12 | Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields |
| CVE-2022-44031 | RE Redmine Redmine | 6.1 | Dec 12 | Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields |
| CVE-2022-44030 | RE Redmine Redmine | 7.5 | Dec 6 | Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks |
| CVE-2021-42326 | RE Redmine Redmine | 5.3 | Oct 12 | Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter |
| CVE-2021-37156 | RE Redmine Redmine | 7.5 | Aug 5 | Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to… |
| CVE-2021-31866 | RE Redmine Redmine | 5.3 | Apr 28 | Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations… |
| CVE-2021-31865 | RE Redmine Redmine | 5.3 | Apr 28 | Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments |
| CVE-2021-31864 | RE Redmine Redmine | 5.3 | Apr 28 | Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incoming mail handler |
| CVE-2021-31863 | RE Redmine Redmine | 7.5 | Apr 28 | Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local… |
| CVE-2021-30164 | RE Redmine Redmine | 9.8 | Apr 6 | Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API |
| CVE-2021-30163 | RE Redmine Redmine | 7.5 | Apr 6 | Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values |
| CVE-2020-36308 | RE Redmine Redmine | 5.3 | Apr 6 | Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries |
| CVE-2020-36307 | RE Redmine Redmine | 6.1 | Apr 6 | Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links |
| CVE-2020-36306 | RE Redmine Redmine | 6.1 | Apr 6 | Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field |
| CVE-2019-25026 | RE Redmine Redmine | 5.3 | Apr 6 | Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting |
| CVE-2021-29274 | RE Redmine Redmine | 6.1 | Mar 29 | Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip |
| CVE-2019-18890 | RE Redmine Redmine | 6.5 | Nov 21 | A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query |
| CVE-2019-17427 | RE Redmine Redmine | 6.1 | Oct 10 | In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors |
| CVE-2017-18026 | RE Redmine Redmine | 8.8 | Jan 10 | Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to… |
| CVE-2017-16804 | RE Redmine Redmine | 4.3 | Nov 13 | In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users… |
| CVE-2017-15577 | RE Redmine Redmine | 7.5 | Oct 18 | Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information |
| CVE-2017-15576 | RE Redmine Redmine | 7.5 | Oct 18 | Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information |
| CVE-2017-15575 | RE Redmine Redmine | 7.3 | Oct 18 | In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers… |
| CVE-2017-15574 | RE Redmine Redmine | 6.1 | Oct 18 | In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment |
| CVE-2017-15573 | RE Redmine Redmine | 6.1 | Oct 18 | In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content |
| CVE-2017-15572 | RE Redmine Redmine | 7.5 | Oct 18 | In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password… |
| CVE-2017-15571 | RE Redmine Redmine | 6.1 | Oct 18 | In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data |
| CVE-2017-15570 | RE Redmine Redmine | 6.1 | Oct 18 | In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data |
| CVE-2017-15569 | RE Redmine Redmine | 6.1 | Oct 18 | In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled… |
| CVE-2017-15568 | RE Redmine Redmine | 6.1 | Oct 18 | In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is… |
| CVE-2016-10515 | RE Redmine Redmine | 6.1 | Oct 18 | In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages |
| CVE-2015-8477 | RE Redmine Redmine | 6.1 | May 23 | Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering |
| CVE-2015-8537 | RE Redmine Redmine | 5.3 | Apr 12 | app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom… |
| CVE-2015-8474 | RE Redmine Redmine | 7.4 | Apr 12 | Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows… |
| CVE-2015-8473 | RE Redmine Redmine | 4.3 | Apr 12 | The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by… |
| CVE-2015-8346 | RE Redmine Redmine | 5.3 | Apr 12 | app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of… |
| CVE-2013-4663 | RG Redmine Git Hosting Plugin Redmine | – | Dec 28 | git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to… |
| CVE-2014-1985 | RE Redmine Redmine | – | Apr 11 | Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote… |
| CVE-2011-4929 | RE Redmine Redmine | – | Oct 8 | Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors |
| CVE-2011-4928 | RE Redmine Redmine | – | Oct 8 | Cross-site scripting (XSS) vulnerability in the textile formatter in Redmine before 1.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors |
| CVE-2011-4927 | RE Redmine Redmine | – | Oct 8 | Unspecified vulnerability in the bazaar repository adapter in Redmine 1.0.x before 1.0.5 allows remote authenticated users to obtain sensitive information via unknown vectors |
| CVE-2012-2054 | RE Redmine Redmine | – | Apr 5 | Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment,… |
| CVE-2012-0327 | RE Redmine Redmine | – | Apr 5 | Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors |
| CVE-2011-1723 | RE Redmine Redmine | – | Apr 19 | Cross-site scripting (XSS) vulnerability in app/views/layouts/base.rhtml in Redmine 1.0.1 through 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the… |
| CVE-2009-4459 | RE Redmine Redmine | – | Dec 30 | Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and… |
| CVE-2009-4079 | RE Redmine Redmine | – | Nov 25 | Cross-site request forgery (CSRF) vulnerability in Redmine 0.8.5 and earlier allows remote attackers to hijack the authentication of users for requests that delete a ticket via… |
| CVE-2009-4078 | RE Redmine Redmine | – | Nov 25 | Multiple cross-site scripting (XSS) vulnerabilities in Redmine 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors |
| CVE-2008-4481 | RE Redmine Redmine | – | Oct 8 | Cross-site scripting (XSS) vulnerability in Redmine 0.7.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors |