Roundup-Tracker Roundup
14 CVEs affecting Roundup-Tracker Roundup. Latest disclosed: 2025-07-13. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53865 | Medium | 6.4 | 2025-07-13 | In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive). |
CVE-2012-6133 | Medium | 6.1 | 2020-01-30 | Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_mess… |
CVE-2019-10904 | Medium | 6.1 | 2019-04-06 | Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. |
CVE-2024-39126 | Medium | 5.4 | 2024-07-17 | Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. |
CVE-2024-39125 | Medium | 5.4 | 2024-07-17 | Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. |
CVE-2024-39124 | Medium | 5.4 | 2024-07-17 | In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS. |
CVE-2014-6276 | Medium | 4.3 | 2016-04-13 | schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obta… |
CVE-2012-6131 | | 2014-04-11 | Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @acti… | |
CVE-2012-6130 | | 2014-04-11 | Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a u… | |
CVE-2012-6132 | | 2014-04-10 | Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter. | |
CVE-2010-2491 | | 2010-09-24 | Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the templ… | |
CVE-2008-1475 | | 2008-03-24 | The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties v… | |
CVE-2008-1474 | | 2008-03-24 | Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS). | |
CVE-2004-1444 | | 2004-12-31 | Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via .. (dot dot) sequences in an @@ command in a… |