Search for packages
| purl | pkg:pypi/roundup@0.7.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3tr4-c65w-fbay
Aliases: CVE-2012-6132 PYSEC-2014-96 |
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter. |
Affected by 6 other vulnerabilities. |
|
VCID-bqn7-yjp5-6yf6
Aliases: CVE-2012-6133 GHSA-5jq3-8437-x35p PYSEC-2020-212 |
Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*. |
Affected by 6 other vulnerabilities. |
|
VCID-csmv-58s1-5bde
Aliases: CVE-2019-10904 GHSA-926q-wxr6-3crq PYSEC-2019-201 |
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. |
Affected by 5 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-fg7q-khn3-q7hr
Aliases: CVE-2014-6276 GHSA-j556-q367-2gw6 PYSEC-2016-33 |
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details. |
Affected by 5 other vulnerabilities. |
|
VCID-fnpw-g6sy-1ucd
Aliases: CVE-2010-2491 PYSEC-2010-31 |
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program. |
Affected by 10 other vulnerabilities. |
|
VCID-fp9t-1frx-hucu
Aliases: CVE-2008-1474 GHSA-c3qv-mf8h-434r PYSEC-2008-9 |
Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS). |
Affected by 12 other vulnerabilities. |
|
VCID-jt1z-2fwz-kfgg
Aliases: CVE-2008-1475 GHSA-j59j-h3g7-cpmf PYSEC-2008-10 |
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods. |
Affected by 0 other vulnerabilities. |
|
VCID-mmv7-4kw7-kbex
Aliases: CVE-2012-6131 GHSA-gw2q-cgvq-9g3v PYSEC-2014-16 |
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1. |
Affected by 6 other vulnerabilities. |
|
VCID-ntht-6gus-87cv
Aliases: CVE-2025-53865 PYSEC-2025-69 |
In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive). |
Affected by 0 other vulnerabilities. |
|
VCID-uk8q-2vzm-hbhu
Aliases: CVE-2024-39126 PYSEC-2024-65 |
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. |
Affected by 1 other vulnerability. |
|
VCID-wjqt-h4bh-gbgr
Aliases: CVE-2024-39124 PYSEC-2024-63 |
In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS. |
Affected by 1 other vulnerability. |
|
VCID-x33h-j6fk-g3hm
Aliases: CVE-2012-6130 PYSEC-2014-15 |
Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link. |
Affected by 6 other vulnerabilities. |
|
VCID-zk4h-xznt-n3c3
Aliases: CVE-2024-39125 PYSEC-2024-64 |
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||