Roundup

CVE-2024-39126 Jul 17, 20:15 PyPI MEDIUM PATCH This Month

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-39125 Jul 17, 20:15 PyPI MEDIUM PATCH This Month

Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-39124 Jul 17, 20:15 PyPI MEDIUM PATCH This Month

In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2019-10904 Apr 06, 20:29 PyPI MEDIUM POC PATCH This Month

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2014-6276 Apr 13, 14:59 PyPI MEDIUM PATCH This Month

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2012-6131 Apr 11, 15:55 PyPI MEDIUM PATCH This Month

Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.

CVE-2012-6130 Apr 11, 15:55 PyPI MEDIUM PATCH This Month

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.

CVE-2012-6132 Apr 10, 20:29 PyPI MEDIUM PATCH This Month

Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.