Show filters
14 Total Results
Displaying 1-10 of 14
Sort by:
Attacker Value
Unknown
CVE-2024-39126
Disclosure Date: July 17, 2024 (last updated August 03, 2024)
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
0
Attacker Value
Unknown
CVE-2024-39125
Disclosure Date: July 17, 2024 (last updated August 03, 2024)
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.
0
Attacker Value
Unknown
CVE-2024-39124
Disclosure Date: July 17, 2024 (last updated August 03, 2024)
In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
0
Attacker Value
Unknown
CVE-2012-6133
Disclosure Date: January 30, 2020 (last updated February 21, 2025)
Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.
0
Attacker Value
Unknown
CVE-2019-10904
Disclosure Date: April 06, 2019 (last updated November 27, 2024)
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
0
Attacker Value
Unknown
CVE-2014-6276
Disclosure Date: April 13, 2016 (last updated November 25, 2024)
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
0
Attacker Value
Unknown
CVE-2012-6130
Disclosure Date: April 11, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.
0
Attacker Value
Unknown
CVE-2012-6131
Disclosure Date: April 11, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.
0
Attacker Value
Unknown
CVE-2012-6132
Disclosure Date: April 10, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
0
Attacker Value
Unknown
CVE-2010-2491
Disclosure Date: September 24, 2010 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program.
0
