- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 15 · 4 medium
- Registry
- PyPI
Advisories 15
- CVE-2025-53865Medium 6.4
In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).
Affected: fixed in 2.5.0.
- CVE-2024-39126Medium 5.4
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
Affected: fixed in 2.4.0.
- CVE-2024-39125Medium 5.4
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.
Affected: fixed in 2.4.0.
- CVE-2024-39124Medium 6.1
In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
Affected: fixed in 2.4.0.
- CVE-2012-6133Unrated
Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML…
Affected: fixed in 1.4.20.
- CVE-2019-10904Unrated
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
Affected: fixed in 2.0.0alpha0; fixed in 2.0.0.
- CVE-2014-6276Unrated
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote…
Affected: fixed in 1.5.1.
- CVE-2012-6131Unrated
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script…
Affected: fixed in 1.4.20.
- CVE-2012-6130Unrated
Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web…
Affected: fixed in 1.4.20.
- CVE-2012-6132Unrated
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the…
Affected: fixed in 1.4.20.
- CVE-2010-2491Unrated
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script…
Affected: fixed in 1.4.14.
- CVE-2009-2737Unrated
The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly…
Affected: from 1.2, fixed in 1.2.1; from 1.4, fixed in 1.4.7; from 1.2, fixed in 1.2.1; from 1.4, fixed in 1.4.7.
- CVE-2008-1475Unrated
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read…
Affected: fixed in 1.4.5.
- CVE-2008-1474Unrated
Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to…
Affected: fixed in 1.4.4.
- CVE-2004-1444Unrated
Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via ..
Affected: fixed in 0.7.3.