Vulnerabilities

TI-2025-33750 CVE-2025-53865 · GHSA-qxh9-qmf2-rhwc

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

LOW 28

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00215 Published 2025-07-13 Fixed in 2.5.0 CWE-79

TI-2024-26181 CVE-2024-39126 · GHSA-x37x-qf4v-f54f

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.

LOW 24

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00324 Published 2024-07-17 Fixed in 2.4.0 CWE-79

TI-2024-26180 CVE-2024-39125 · GHSA-xjgw-ghrx-wfff

Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.

LOW 24

Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00286 Published 2024-07-17 Fixed in 2.4.0 CWE-79

TI-2024-26179 CVE-2024-39124 · GHSA-w8vc-cwv9-wx67

In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.

LOW 27

In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00289 Published 2024-07-17 Fixed in 2.4.0 CWE-79

TI-2012-05095 CVE-2012-6133 · GHSA-5jq3-8437-x35p

Cross-site scripting in Roundup

LOW 30

Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0156 Published 2020-01-30 Fixed in 1.4.20 CWE-79

TI-2019-08125 CVE-2019-10904 · GHSA-926q-wxr6-3crq

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.

LOW 30

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01581 Published 2019-04-06 Fixed in 2.0.0alpha0 CWE-79

TI-2014-05162 CVE-2014-6276 · GHSA-j556-q367-2gw6

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default…

LOW 23

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01578 Published 2016-04-13 Fixed in 1.5.1 CWE-264

TI-2012-05093 CVE-2012-6131 · GHSA-gw2q-cgvq-9g3v

Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows…

LOW 24

Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01992 Published 2014-04-11 Fixed in 1.4.20 CWE-79

TI-2012-05092 CVE-2012-6130 · GHSA-mccq-3m7h-fjxg

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20…

LOW 24

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01992 Published 2014-04-11 Fixed in 1.4.20 CWE-79

TI-2012-05094 CVE-2012-6132 · GHSA-5v6q-xqq8-g4xj

Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers…

LOW 24

Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0183 Published 2014-04-10 Fixed in 1.4.20 CWE-79

TI-2010-02391 CVE-2010-2491 · GHSA-frgf-rv99-862x

Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows…

LOW 25

Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02541 Published 2010-09-24 Fixed in 1.4.14 CWE-79

TI-2008-01412 CVE-2008-1475 · GHSA-j59j-h3g7-cpmf

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows…

LOW 32

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.01743 Published 2008-03-24 Fixed in 1.4.5 CWE-264

TI-2008-01411 CVE-2008-1474 · GHSA-c3qv-mf8h-434r

Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and…

LOW 23

Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS).

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01486 Published 2008-03-24 Fixed in 1.4.4 CWE-79

TI-2004-01321 CVE-2004-1444 · GHSA-q7mf-hp9m-cx6f

Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to…

LOW 34

Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08865 Published 2005-02-13 Fixed in 0.7.3 CWE-22

Vulnerabilities

Filters