CVE-2021-30163

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Apr 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-301649.8Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues A CVE-2021-301658.1The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware CVE-2021-301667.2The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a comman CVE-2021-301679.8The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and furth CVE-2021-301689.8The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential CVE-2021-301697.5The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.CVE-2021-30177.5The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the CVE-2021-301705.4Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject CVE-2021-301715.4Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious Ja CVE-2021-301725.4Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authent CVE-2021-301736.5Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path in CVE-2021-301745.4RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow re