Search for packages
| purl | pkg:pypi/roundup@0.8.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1w67-ygzj-fugz
Aliases: CVE-2014-6276 GHSA-j556-q367-2gw6 PYSEC-2016-33 |
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details. |
Affected by 5 other vulnerabilities. |
|
VCID-7kxe-bm1g-eyhe
Aliases: CVE-2012-6131 GHSA-gw2q-cgvq-9g3v PYSEC-2014-16 |
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1. |
Affected by 6 other vulnerabilities. |
|
VCID-9qv2-nkkm-53ae
Aliases: CVE-2012-6130 PYSEC-2014-15 |
Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link. |
Affected by 6 other vulnerabilities. |
|
VCID-9ydc-txfc-pqe6
Aliases: CVE-2025-53865 PYSEC-2025-69 |
In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive). |
Affected by 0 other vulnerabilities. |
|
VCID-agp7-u68t-abbe
Aliases: CVE-2024-39124 PYSEC-2024-63 |
In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS. |
Affected by 1 other vulnerability. |
|
VCID-be33-dgsb-nycm
Aliases: CVE-2019-10904 GHSA-926q-wxr6-3crq PYSEC-2019-201 |
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. |
Affected by 5 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-m8r5-mtwf-cbgm
Aliases: CVE-2024-39126 PYSEC-2024-65 |
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. |
Affected by 1 other vulnerability. |
|
VCID-mz57-w4e7-k7gw
Aliases: CVE-2010-2491 PYSEC-2010-31 |
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program. |
Affected by 10 other vulnerabilities. |
|
VCID-rpbj-pyv7-3kag
Aliases: CVE-2012-6132 PYSEC-2014-96 |
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter. |
Affected by 6 other vulnerabilities. |
|
VCID-v7q2-pt76-qbb4
Aliases: CVE-2008-1475 GHSA-j59j-h3g7-cpmf PYSEC-2008-10 |
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods. |
Affected by 0 other vulnerabilities. |
|
VCID-vg3s-h9xc-83cx
Aliases: CVE-2008-1474 GHSA-c3qv-mf8h-434r PYSEC-2008-9 |
Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS). |
Affected by 12 other vulnerabilities. |
|
VCID-yufw-2bru-h7h1
Aliases: CVE-2024-39125 PYSEC-2024-64 |
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. |
Affected by 1 other vulnerability. |
|
VCID-zbqf-gvrf-m3fs
Aliases: CVE-2012-6133 GHSA-5jq3-8437-x35p PYSEC-2020-212 |
Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*. |
Affected by 6 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||