Redmine vulnerabilities
4 known CVE vulnerabilities in Redmine, translated and rated.
- CVE-2017-15577High
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.
- CVE-2017-15576High
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
- CVE-2017-15575High
In Redmine before 3.2.6 and 3.3.x before 3.3.3, there is a lack of a check for whether the Repository module is enabled in a project's settings. This may allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.
- CVE-2017-15572High
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.