Security Vulnerabilities - CVEs Published In April 2021
Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.
CVSS Score
5.3
EPSS Score
0.004
Published
2021-04-06
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.
CVSS Score
6.1
EPSS Score
0.003
Published
2021-04-06
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.
CVSS Score
6.1
EPSS Score
0.004
Published
2021-04-06
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.
CVSS Score
5.3
EPSS Score
0.004
Published
2021-04-06
An issue was discovered on LG mobile devices with Android OS 11 software. Attackers can bypass the lockscreen protection mechanism after an incoming call has been terminated. The LG ID is LVE-SMP-210002 (April 2021).
CVSS Score
5.5
EPSS Score
0.0
Published
2021-04-06
An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. Attackers can leverage ISMS services to bypass access control on specific content providers. The LG ID is LVE-SMP-210003 (April 2021).
CVSS Score
7.1
EPSS Score
0.0
Published
2021-04-06
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.
CVSS Score
7.5
EPSS Score
0.005
Published
2021-04-06
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.
CVSS Score
9.8
EPSS Score
0.002
Published
2021-04-06
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
CVSS Score
6.1
EPSS Score
0.011
Published
2021-04-06
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.
CVSS Score
6.1
EPSS Score
0.01
Published
2021-04-06