Vulnerabilities > Redmine > Redmine > 3.3.6
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2021-04-06 | CVE-2021-30164 | Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API. | 7.5 |
2021-04-06 | CVE-2021-30163 | Information Exposure vulnerability in multiple products Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values. | 5.0 |
2021-04-06 | CVE-2020-36308 | Injection vulnerability in multiple products Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries. | 5.0 |
2021-04-06 | CVE-2020-36307 | Cross-site Scripting vulnerability in multiple products Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links. | 4.3 |
2021-04-06 | CVE-2020-36306 | Cross-site Scripting vulnerability in multiple products Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field. | 4.3 |
2021-04-06 | CVE-2019-25026 | Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting. | 5.0 |
2019-11-21 | CVE-2019-18890 | SQL Injection vulnerability in multiple products A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query. | 4.0 |
2019-10-10 | CVE-2019-17427 | Cross-site Scripting vulnerability in Redmine In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. | 4.3 |