Known vulnerabilities in Redmine

Vendor: Ruby
Software: Redmine
Software CPE: cpe:2.3:a:ruby:redmine:*:*:*:*:*:*:*:*
Total vulnerabilities: 24
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Redmine Redmine is affected by 24 known vulnerabilities: 1 high, 13 medium, 10 low Critical High Medium Low

Vulnerabilities (24)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU83335 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-47259
CWE-79 Low
No
No
4.2.11, 5.0.6 21.11.2023 SB2023112117
#VU70320 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-44637
CWE-79 Low
No
No
4.2.9, 5.0.4 14.12.2022 SB2022121421
#VU52847 - Security Features
CVE-2021-31865
CWE-254 Medium
No
No
4.0.9, 4.1.3, 4.2.1 04.05.2021 SB2021050413
#VU52846 - Exposure of sensitive information to an unauthorized actor
CVE-2021-31866
CWE-200 Medium
No
No
4.0.9, 4.1.3 04.05.2021 SB2021050413
#VU52845 - Exposure of sensitive information to an unauthorized actor
CVE-2021-31863
CWE-200 Medium
No
No
4.0.9, 4.1.3, 4.2.1 04.05.2021 SB2021050413
#VU52844 - Security Features
CVE-2021-31864
CWE-254 Medium
No
No
4.0.9, 4.1.3, 4.2.1 04.05.2021 SB2021050413
#VU52048 - Exposure of sensitive information to an unauthorized actor
CVE-2020-36308
CWE-200 Medium
No
No
4.0.7, 4.1.1 12.04.2021 SB2021040910
#VU52047 - Exposure of sensitive information to an unauthorized actor
CVE-2021-30163
CWE-200 Medium
No
No
4.0.8, 4.1.2 12.04.2021 SB2021041215
#VU52046 - Security Features
CVE-2021-30164
CWE-254 Medium
No
No
4.0.8, 4.1.2 12.04.2021 SB2021041215
#VU52045 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-36307
CWE-79 Low
No
No
4.0.7, 4.1.1 12.04.2021 SB2021040910
#VU52024 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-36306
CWE-79 Low
No
No
4.0.7, 4.1.1 09.04.2021 SB2021040910
#VU48586 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.1.2 21.11.2020 SB2020112102
#VU22884 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-18890
CWE-89 High
No
No
3.3.10 21.11.2019 SB2019112110
SB2019112114
SB2019112619
#VU22883 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-17427
CWE-79 Medium
No
No
3.4.11, 4.0.4 21.11.2019 SB2019112110
SB2019112114
SB2019112619
#VU40389 - Exposure of sensitive information to an unauthorized actor
CVE-2015-8537
CWE-200 Medium
No
No
- 12.04.2016 SB2016041226
#VU40390 - Improper input validation
CVE-2015-8474
CWE-20 Medium
No
No
- 12.04.2016 SB2016041226
#VU40391 - Exposure of sensitive information to an unauthorized actor
CVE-2015-8473
CWE-200 Low
No
No
- 12.04.2016 SB2016041226
#VU41838 - Improper input validation
CVE-2014-1985
CWE-20 Medium
No
No
- 11.04.2014 SB2014041106
#VU43417 - Improper input validation
CVE-2011-4929
CWE-20 Medium
Available
No
- 08.10.2012 SB2012100801
#VU43419 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2011-4928
CWE-79 Low
No
No
1.0.5 08.10.2012 SB2012100802


Showing elements 1 - 20 out of 24