edgewall vulnerabilities

Products

• trac 3
• firestats 1

Latest edgewall CVEs

Newest publication first

1. CVE-2010-5108 Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permission...

   Published 2019-11-13

   High·CVSS 7.5 EPSS 1.3%

   Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permissions.

2. CVE-2009-4405 Trac is vulnerable to improper policy checks and missing 'raw' role check in docutils

   Published 2009-12-23

   High·CVSS 7.5 EPSS 2.0%

   Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."

3. CVE-2009-2144 FireStats <1.6.2 - SQL Injection

   Published 2009-06-22

   High·CVSS 7.5 EPSS 2.0%

   SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

4. CVE-2008-2951 Trac Open Redirect vulnerability

   Published 2008-07-27

   Medium·CVSS 6.1 EPSS 1.8%

   Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.