Refine your search

11 vulnerabilities found for Redmine by Redmine

CERTFR-2026-AVI-1085
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans Redmine. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Redmine Redmine Redmine versions antérieures à 6.0.11
Redmine Redmine Redmine versions 7.x antérieures à 7.0.1
Redmine Redmine Redmine versions 6.1.x antérieures à 6.1.4
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Redmine versions ant\u00e9rieures \u00e0 6.0.11",
      "product": {
        "name": "Redmine",
        "vendor": {
          "name": "Redmine",
          "scada": false
        }
      }
    },
    {
      "description": "Redmine versions 7.x ant\u00e9rieures \u00e0 7.0.1",
      "product": {
        "name": "Redmine",
        "vendor": {
          "name": "Redmine",
          "scada": false
        }
      }
    },
    {
      "description": "Redmine versions 6.1.x ant\u00e9rieures \u00e0 6.1.4",
      "product": {
        "name": "Redmine",
        "vendor": {
          "name": "Redmine",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2026-08-26T00:00:00",
  "last_revision_date": "2026-08-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1085",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-08-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Redmine. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Redmine",
  "vendor_advisories": [
    {
      "published_at": "2026-08-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Redmine security_advisories",
      "url": "https://www.redmine.org/projects/redmine/wiki/security_advisories"
    }
  ]
}

CERTFR-2026-AVI-0754
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans Redmine. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Redmine Redmine Redmine versions antérieures à 5.1.13
Redmine Redmine Redmine versions 6.1.x antérieures à 6.1.3
Redmine Redmine Redmine versions 6.0.x antérieures à 6.0.10
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Redmine versions ant\u00e9rieures \u00e0 5.1.13",
      "product": {
        "name": "Redmine",
        "vendor": {
          "name": "Redmine",
          "scada": false
        }
      }
    },
    {
      "description": "Redmine versions 6.1.x ant\u00e9rieures \u00e0 6.1.3",
      "product": {
        "name": "Redmine",
        "vendor": {
          "name": "Redmine",
          "scada": false
        }
      }
    },
    {
      "description": "Redmine versions 6.0.x ant\u00e9rieures \u00e0 6.0.10",
      "product": {
        "name": "Redmine",
        "vendor": {
          "name": "Redmine",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2026-06-16T00:00:00",
  "last_revision_date": "2026-06-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0754",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Redmine. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Redmine",
  "vendor_advisories": [
    {
      "published_at": "2026-08-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Redmine security_advisories",
      "url": "https://www.redmine.org/projects/redmine/wiki/security_advisories"
    }
  ]
}

CERTFR-2026-AVI-0306
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans Redmine. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS), un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Redmine Redmine Redmine versions antérieures à 5.1.12
Redmine Redmine Redmine versions 6.0.x antérieures à 6.0.9
Redmine Redmine Redmine versions 6.1.x antérieures à 6.1.2
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Redmine versions ant\u00e9rieures \u00e0 5.1.12",
      "product": {
        "name": "Redmine",
        "vendor": {
          "name": "Redmine",
          "scada": false
        }
      }
    },
    {
      "description": "Redmine versions 6.0.x ant\u00e9rieures \u00e0 6.0.9",
      "product": {
        "name": "Redmine",
        "vendor": {
          "name": "Redmine",
          "scada": false
        }
      }
    },
    {
      "description": "Redmine versions 6.1.x ant\u00e9rieures \u00e0 6.1.2",
      "product": {
        "name": "Redmine",
        "vendor": {
          "name": "Redmine",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2026-03-17T00:00:00",
  "last_revision_date": "2026-03-17T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0306",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-03-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Redmine. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS), un contournement de la politique de s\u00e9curit\u00e9 et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Redmine",
  "vendor_advisories": [
    {
      "published_at": "2026-08-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Redmine security_advisories",
      "url": "https://www.redmine.org/projects/redmine/wiki/security_advisories"
    }
  ]
}

CVE-2026-1836 (GCVE-0-2026-1836)
Vulnerability from cvelistv5
Published
2026-06-12 13:23
Modified
2026-06-12 14:00
Severity ?
5.3 (Medium) - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-257 - Storing passwords in a recoverable format
Summary
The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.
References
Impacted products
Vendor Product Version
Redmine Redmine Version: 0   < 6.0.7
Version: 0   < 5.1.10
Version: 0   < 5.0.14
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1836",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T14:00:02.963086Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T14:00:11.755Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Redmine",
          "vendor": "Redmine",
          "versions": [
            {
              "lessThan": "6.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.14",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "6.0.7"
            },
            {
              "status": "unaffected",
              "version": "5.1.10"
            },
            {
              "status": "unaffected",
              "version": "5.0.14"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.7",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.1.10",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.14",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redmine:redmine:6.0.7:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:redmine:redmine:5.1.10:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:redmine:redmine:5.0.14:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "datePublic": "2026-03-31T10:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials."
            }
          ],
          "value": "The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-257",
              "description": "CWE-257 Storing passwords in a recoverable format",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T13:23:31.810Z",
        "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
        "shortName": "INCIBE"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/stored-credentials-redmine"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The vulnerability has been fixed by Redmine team in versions 6.0.7, 5.1.10 and 5.0.14."
            }
          ],
          "value": "The vulnerability has been fixed by Redmine team in versions 6.0.7, 5.1.10 and 5.0.14."
        }
      ],
      "source": {
        "defect": [
          "David Rubio Lora"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Stored credentials in Redmine",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
    "assignerShortName": "INCIBE",
    "cveId": "CVE-2026-1836",
    "datePublished": "2026-06-12T13:23:31.810Z",
    "dateReserved": "2026-02-03T15:43:30.850Z",
    "dateUpdated": "2026-06-12T14:00:11.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

jvndb-2023-000116
Vulnerability from jvndb
Published
2023-11-17 14:32
Modified
2024-05-09 17:55
Severity ?
6.1 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Redmine vulnerable to cross-site scripting
Details
Redmine contains a cross-site scripting vulnerability (CWE-79) due to improper character string processing. Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000116.html",
  "dc:date": "2024-05-09T17:55+09:00",
  "dcterms:issued": "2023-11-17T14:32+09:00",
  "dcterms:modified": "2024-05-09T17:55+09:00",
  "description": "Redmine contains a cross-site scripting vulnerability (CWE-79) due to improper character string processing.\r\n\r\nShiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000116.html",
  "sec:cpe": {
    "#text": "cpe:/a:redmine:redmine",
    "@product": "Redmine",
    "@vendor": "Redmine",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "6.1",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000116",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN13618065/index.html",
      "@id": "JVN#13618065",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-47259",
      "@id": "CVE-2023-47259",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-47259",
      "@id": "CVE-2023-47259",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Redmine vulnerable to cross-site scripting"
}

jvndb-2022-000096
Vulnerability from jvndb
Published
2022-12-13 14:05
Modified
2024-06-03 16:47
Severity ?
6.1 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Redmine vulnerable to cross-site scripting
Details
Redmine contains a cross-site scripting vulnerability (CWE-79) caused by improper Textile processing. Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000096.html",
  "dc:date": "2024-06-03T16:47+09:00",
  "dcterms:issued": "2022-12-13T14:05+09:00",
  "dcterms:modified": "2024-06-03T16:47+09:00",
  "description": "Redmine contains a cross-site scripting vulnerability (CWE-79) caused by improper Textile processing.\r\n\r\nShiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000096.html",
  "sec:cpe": {
    "#text": "cpe:/a:redmine:redmine",
    "@product": "Redmine",
    "@vendor": "Redmine",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "6.1",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000096",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN60211811/index.html",
      "@id": "JVN#60211811",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-44637",
      "@id": "CVE-2022-44637",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-44637",
      "@id": "CVE-2022-44637",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Redmine vulnerable to cross-site scripting"
}

jvndb-2014-000041
Vulnerability from jvndb
Published
2014-04-16 15:06
Modified
2014-04-16 15:06
Severity ?
() - -
Summary
Redmine vulnerable to open redirect
Details
Redmine is a project management software. Redmine contains an open redirect vulnerability due to insufficient checking of the URL parameter. Minoru Sakai of SCSK Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000041.html",
  "dc:date": "2014-04-16T15:06+09:00",
  "dcterms:issued": "2014-04-16T15:06+09:00",
  "dcterms:modified": "2014-04-16T15:06+09:00",
  "description": "Redmine is a project management software. Redmine contains an open redirect vulnerability due to insufficient checking of the URL parameter.\r\n\r\nMinoru Sakai of SCSK Corporation reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000041.html",
  "sec:cpe": {
    "#text": "cpe:/a:redmine:redmine",
    "@product": "Redmine",
    "@vendor": "Redmine",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000041",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN93004610/index.html",
      "@id": "JVN#93004610",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1985",
      "@id": "CVE-2014-1985",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1985",
      "@id": "CVE-2014-1985",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "Redmine vulnerable to open redirect"
}

jvndb-2012-000025
Vulnerability from jvndb
Published
2012-03-13 13:39
Modified
2012-03-13 13:39
Severity ?
() - -
Summary
Redmine vulnerable to cross-site scripting
Details
Redmine contains a cross-site scripting vulnerability. Redmine is a project management software. Redmine contains a cross-site scripting vulnerability. Kousuke Ebihara reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000025.html",
  "dc:date": "2012-03-13T13:39+09:00",
  "dcterms:issued": "2012-03-13T13:39+09:00",
  "dcterms:modified": "2012-03-13T13:39+09:00",
  "description": "Redmine contains a cross-site scripting vulnerability.\r\n\r\nRedmine is a project management software. Redmine contains a cross-site scripting vulnerability.\r\n\r\nKousuke Ebihara reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000025.html",
  "sec:cpe": {
    "#text": "cpe:/a:redmine:redmine",
    "@product": "Redmine",
    "@vendor": "Redmine",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2012-000025",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN93406632/index.html",
      "@id": "JVN#93406632",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0327",
      "@id": "CVE-2012-0327",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0327",
      "@id": "CVE-2012-0327",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Redmine vulnerable to cross-site scripting"
}

jvndb-2009-000073
Vulnerability from jvndb
Published
2009-11-19 15:45
Modified
2009-11-19 15:45
Severity ?
() - -
Summary
Redmine vulnerable to cross-site scripting
Details
Redmine contains a cross-site scripting vulnerability. Redmine is a project management software. Redmine contains a cross-site scripting vulnerability. Yoshinari Fukumoto of Rakuten, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000073.html",
  "dc:date": "2009-11-19T15:45+09:00",
  "dcterms:issued": "2009-11-19T15:45+09:00",
  "dcterms:modified": "2009-11-19T15:45+09:00",
  "description": "Redmine contains a cross-site scripting vulnerability.\r\n\r\nRedmine is a project management software. Redmine contains a cross-site scripting vulnerability.\r\n\r\nYoshinari Fukumoto of Rakuten, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000073.html",
  "sec:cpe": {
    "#text": "cpe:/a:redmine:redmine",
    "@product": "Redmine",
    "@vendor": "Redmine",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2009-000073",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN01245481/index.html",
      "@id": "JVN#01245481",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4078",
      "@id": "CVE-2009-4078",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4078",
      "@id": "CVE-2009-4078",
      "@source": "NVD"
    },
    {
      "#text": "http://secunia.com/advisories/37420",
      "@id": "SA37420",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://www.securityfocus.com/bid/37066",
      "@id": "37066",
      "@source": "BID"
    },
    {
      "#text": "http://xforce.iss.net/xforce/xfdb/54333",
      "@id": "54333",
      "@source": "XF"
    },
    {
      "#text": "http://www.vupen.com/english/advisories/2009/3291",
      "@id": "VUPEN/ADV-2009-3291",
      "@source": "VUPEN"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Redmine vulnerable to cross-site scripting"
}

jvndb-2009-000074
Vulnerability from jvndb
Published
2009-11-19 15:45
Modified
2009-11-19 15:45
Severity ?
() - -
Summary
Redmine vulnerable to cross-site request forgery
Details
Redmine contains a cross-site request forgery vulnerability. Redmine is a project management software. Redmine contains a cross-site request forgery vulnerability. Yoshinari Fukumoto of Rakuten, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000074.html",
  "dc:date": "2009-11-19T15:45+09:00",
  "dcterms:issued": "2009-11-19T15:45+09:00",
  "dcterms:modified": "2009-11-19T15:45+09:00",
  "description": "Redmine contains a cross-site request forgery vulnerability.\r\n\r\nRedmine is a project management software. Redmine contains a cross-site request forgery vulnerability.\r\n\r\nYoshinari Fukumoto of Rakuten, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000074.html",
  "sec:cpe": {
    "#text": "cpe:/a:redmine:redmine",
    "@product": "Redmine",
    "@vendor": "Redmine",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2009-000074",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN87341298/index.html",
      "@id": "JVN#87341298",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4079",
      "@id": "CVE-2009-4079",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4079",
      "@id": "CVE-2009-4079",
      "@source": "NVD"
    },
    {
      "#text": "http://secunia.com/advisories/37420",
      "@id": "SA37420",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://www.securityfocus.com/bid/37066",
      "@id": "37066",
      "@source": "BID"
    },
    {
      "#text": "http://xforce.iss.net/xforce/xfdb/54334",
      "@id": "54334",
      "@source": "XF"
    },
    {
      "#text": "http://www.vupen.com/english/advisories/2009/3291",
      "@id": "VUPEN/ADV-2009-3291",
      "@source": "VUPEN"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "Redmine vulnerable to cross-site request forgery"
}

jvndb-2008-000038
Vulnerability from jvndb
Published
2008-07-08 12:15
Modified
2008-07-08 12:15
Severity ?
() - -
Summary
Redmine vulnerable to cross-site scripting
Details
Redmine, open source project management software, contains a cross-site scripting vulnerbility. Redmine is open source project management software written by Ruby on Rails framework. Redmine contains a cross-site scripting vulnerability. Toshiharu Sugiyama of UBsecure, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000038.html",
  "dc:date": "2008-07-08T12:15+09:00",
  "dcterms:issued": "2008-07-08T12:15+09:00",
  "dcterms:modified": "2008-07-08T12:15+09:00",
  "description": "Redmine, open source project management software, contains a cross-site scripting vulnerbility.\r\n\r\nRedmine is open source project management software written by Ruby on Rails framework. Redmine contains a cross-site scripting vulnerability.\r\n\r\nToshiharu Sugiyama of UBsecure, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000038.html",
  "sec:cpe": {
    "#text": "cpe:/a:redmine:redmine",
    "@product": "Redmine",
    "@vendor": "Redmine",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2008-000038",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN00945448/index.html",
      "@id": "JVN#00945448",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4481",
      "@id": "CVE-2008-4481",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4481",
      "@id": "CVE-2008-4481",
      "@source": "NVD"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000038.html",
      "@id": "JVNDB-2008-000038",
      "@source": "JVNDB_Ja"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Redmine vulnerable to cross-site scripting"
}