Skip to content
Noroxi

Redmine records

51 published records for vendor redmine.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 2%
Pre-auth RCE
3
With a fix record
90.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 21
  5. 22
  6. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

51 records
  • CVE-2011-4929
    44Plan

    Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitr

    HighCVSS 7.5WeaponizedEPSS 46%

    redmine · redmineOct 8, 2012

  • CVE-2021-30164
    39Monitor

    Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues A

    CriticalCVSS 9.8No exploitEPSS 1%

    redmine · redmineApr 6, 2021

  • CVE-2017-18026
    36Monitor

    Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg progra

    HighCVSS 8.8No exploitEPSS 2%

    redmine · redmineJan 10, 2018

  • CVE-2017-15572
    31Monitor

    In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Refer

    HighCVSS 7.5No exploitEPSS 2%

    redmine · redmineOct 17, 2017

  • CVE-2013-4663
    31Monitor

    git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacha

    HighCVSS 7.5No exploitEPSS 1%

    redmine · redmine git hosting pluginDec 27, 2014

  • CVE-2021-31863
    31Monitor

    Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows R

    HighCVSS 7.5No exploitEPSS 1%

    redmine · redmineApr 28, 2021

  • CVE-2015-8474
    30Monitor

    Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x befor

    HighCVSS 7.4No exploitEPSS 1%

    redmine · redmineApr 12, 2016

  • CVE-2017-15576
    30Monitor

    Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensi

    HighCVSS 7.5No exploitEPSS 1%

    redmine · redmineOct 17, 2017

  • CVE-2017-15577
    30Monitor

    Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive inform

    HighCVSS 7.5No exploitEPSS 1%

    redmine · redmineOct 17, 2017

  • CVE-2021-30163
    30Monitor

    Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that h

    HighCVSS 7.5No exploitEPSS 1%

    redmine · redmineApr 6, 2021

  • CVE-2021-37156
    30Monitor

    Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the int

    HighCVSS 7.5No exploitEPSS 1%

    redmine · redmineAug 5, 2021

  • CVE-2022-44030
    30Monitor

    Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks.

    HighCVSS 7.5No exploitEPSS 0%

    redmine · redmineDec 6, 2022

  • CVE-2017-15575
    29Monitor

    In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's setting

    HighCVSS 7.3No exploitEPSS 1%

    redmine · redmineOct 17, 2017

  • CVE-2019-18890
    27Monitor

    A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a cr

    MediumCVSS 6.5Proof of conceptEPSS 4%

    redmine · redmineNov 21, 2019

  • CVE-2009-4079
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in Redmine 0.8.5 and earlier allows remote attackers to hijack the authentication of users f

    MediumCVSS 6.8No exploitEPSS 0%

    redmine · redmineNov 25, 2009

  • CVE-2014-1985
    24Monitor

    Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 an

    MediumCVSS 5.8No exploitEPSS 2%

    redmine · redmineApr 11, 2014

  • CVE-2019-17427
    24Monitor

    In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    redmine · redmineOct 9, 2019

  • CVE-2015-8477
    24Monitor

    Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors

    MediumCVSS 6.1No exploitEPSS 1%

    redmine · redmineMay 23, 2017

  • CVE-2017-15571
    24Monitor

    In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data.

    MediumCVSS 6.1No exploitEPSS 1%

    redmine · redmineOct 17, 2017

  • CVE-2017-15570
    24Monitor

    In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.

    MediumCVSS 6.1No exploitEPSS 1%

    redmine · redmineOct 17, 2017

  • CVE-2017-15573
    24Monitor

    In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content.

    MediumCVSS 6.1No exploitEPSS 1%

    redmine · redmineOct 17, 2017

  • CVE-2017-15574
    24Monitor

    In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment.

    MediumCVSS 6.1No exploitEPSS 1%

    redmine · redmineOct 17, 2017

  • CVE-2017-15568
    24Monitor

    In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field

    MediumCVSS 6.1No exploitEPSS 1%

    redmine · redmineOct 17, 2017

  • CVE-2017-15569
    24Monitor

    In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field wit

    MediumCVSS 6.1No exploitEPSS 0%

    redmine · redmineOct 17, 2017

  • CVE-2021-29274
    24Monitor

    Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.

    MediumCVSS 6.1No exploitEPSS 0%

    redmine · redmineMar 29, 2021