| 0 |
| url |
VCID-1w67-ygzj-fugz |
| vulnerability_id |
VCID-1w67-ygzj-fugz |
| summary |
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-6276, GHSA-j556-q367-2gw6, PYSEC-2016-33
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1w67-ygzj-fugz |
|
| 1 |
| url |
VCID-7kxe-bm1g-eyhe |
| vulnerability_id |
VCID-7kxe-bm1g-eyhe |
| summary |
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2012-6131, GHSA-gw2q-cgvq-9g3v, PYSEC-2014-16
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7kxe-bm1g-eyhe |
|
| 2 |
| url |
VCID-9qv2-nkkm-53ae |
| vulnerability_id |
VCID-9qv2-nkkm-53ae |
| summary |
Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-6130, PYSEC-2014-15
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9qv2-nkkm-53ae |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
| url |
VCID-mz57-w4e7-k7gw |
| vulnerability_id |
VCID-mz57-w4e7-k7gw |
| summary |
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
|
| aliases |
CVE-2010-2491, PYSEC-2010-31
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mz57-w4e7-k7gw |
|
| 8 |
|
| 9 |
|
| 10 |
| url |
VCID-zbqf-gvrf-m3fs |
| vulnerability_id |
VCID-zbqf-gvrf-m3fs |
| summary |
Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-6133, GHSA-5jq3-8437-x35p, PYSEC-2020-212
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zbqf-gvrf-m3fs |
|