Advisories · Technology
Enalean tuleap.
Every CVE that names Enalean tuleap among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.6 Medium
Tuleap is missing CSRF protection in the Overview inconsistent items
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.6 Medium
Tuleap has missing CSRF protections its in tracker field dependencies
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.6 Medium
Tuleap has missing CSRF protections in its tracker trigger management system
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.6 Medium
Tuleap is missing CSRF protections for its planning management API
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.6 Medium
Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
Tuleap exposes releases for all projects to File Release System project administrators
- Enalean tuleap
- Broken access control
- CVSS 4.6 Medium
Tuleap missing CSRF protections in the File Release System
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.6 Medium
Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Tuleap backlog item representations do not verify the permissions of the child trackers
- Enalean tuleap
- CWE-280
- CVSS 5.3 Medium
Tuleap's special and always there fields permissions are not verified in cross-tracker search
- Enalean tuleap
- Broken access control
- CVSS 4.3 Medium
Tuleap exposes artifacts to a mentioned user via email notifications
- Enalean tuleap
- Broken access control
- CVSS 5.4 Medium
Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifact
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Tuleap vulnerable to user enumeration via the lost password form
- Enalean tuleap
- CWE-204
- CVSS 4.6 Medium
Tuleap missing CSRF protection on tracker reports manipulation
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.6 Medium
Tuleap missing CSRF protection on tracker canned responses administration
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Tuleap does not enforce read permissions on parent trackers in the REST API
- Enalean tuleap
- Broken access control
- CVSS 5.3 Medium
Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin
- Enalean tuleap
- Broken access control
- CVSS 4.8 Medium
Tuleap allows XSS via the content of RSS feeds in the RSS widgets
- Enalean tuleap
- Cross-site scripting (XSS)
- CWE-84
- CVSS 4.6 Medium
Tuleap is missing CSRF protection on tracker hierarchy administration
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.6 Medium
Tuleap has missing CSRF protections on artifact submission & edition from the tracker view
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.6 Medium
Tuleap is missing CSRF protections on tracker fields administrative operations
- Enalean tuleap
- Cross-site request forgery (CSRF)
- CVSS 4.6 Medium
In Tuleap, deleting a report can delete criteria filters in other reports
- Enalean tuleap
- CWE-440
- CVSS 4.1 Medium
Tuleap allows content injection via emails sent by the mass emailing features
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Tuleap dumps the Redis password into the generated troubleshooting archives
- Enalean tuleap
- Information disclosure
- CVSS 4.8 Medium
Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Tuleap allows default values to be cleared from field configuration
- Enalean tuleap
- CWE-440
- CVSS 4.3 Medium
Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap
- Enalean tuleap
- CWE-280
- CVSS 5.3 Medium
Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap
- Enalean tuleap
- CWE-280
- CVSS 5.4 Medium
Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Tuleap lists trackers in the quick add actions of the backlog without any permissions check
- Enalean tuleap
- CWE-280
- CVSS 4.9 Medium
Permissions are incorrectly verified for project administrators in the cross tracker search widget
- Enalean tuleap
- CWE-280
- CVSS 4.8 Medium
Tuleap does not properly check permissions for email notifications in trackers
- Enalean tuleap
- CWE-280
- CVSS 4.8 Medium
Tuleap vulnerable to XSS in the HTML mail content of the cross reference field
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Tuleap's recursive permissions to document manager folder are not properly applied
- Enalean tuleap
- CWE-281
- CVSS 4.3 Medium
Tuleap has improper permissions of the backlog items
- Enalean tuleap
- Broken access control
- CVSS 7.6 High
Tuleap deleting or moving an artifact can delete values from unrelated artifacts
- Enalean tuleap
- CWE-440
- CWE-670
- CVSS 5.4 Medium
Tuleap's mass update clears the permissions on artifact field
- Enalean tuleap
- Information disclosure
- CVSS 5.3 Medium
Tuleap's content of artifacts might be readable by unauthorized users
- Enalean tuleap
- Information disclosure
- CVSS 5.4 Medium
Tuleap vulnerable to Cross-site Scripting on the edition page of a release
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Tuleap allows preview of a linked artifact with a type does not respect permissions
- Enalean tuleap
- Broken access control
- CVSS 5.4 Medium
Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 4.1 Medium
User access not updated with privilege change in Tuleap
- Enalean tuleap
- CWE-281
- CVSS 4.8 Medium
Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
XSS in the tooltip via an artifact title
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Cross-site Scripting (XSS) through the name of a color of select box values in tuleap
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Tuleap MediaWiki standalone "readers" can also edit pages
- Enalean tuleap
- Broken access control
- CVSS 4.3 Medium
Tuleap dashboards vulnerable to Incorrect Authorization
- Enalean tuleap
- Broken access control
- CVSS 4.3 Medium
Tuleap subject to Missing Authorization allowing for branch prefix modification
- Enalean tuleap
- Broken access control
- CVSS 5.4 Medium
Fine grained permissions are not checked in Tuleap
- Enalean tuleap
- Broken access control
- CVSS 7.2 High
SQL injection via the field name of a tracker in Tuleap
- Enalean tuleap
- SQL injection
- CVSS 6.5 Medium
Cross site scripting via the title of a document in Tuleap
- Enalean tuleap
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Resources of private projects can be exposed in Tuleap
- Enalean tuleap
- Information disclosure
- CVSS 4.3 Medium
Tracker report renderer and chart widgets leak information in Tuleap
- Enalean tuleap
- Broken access control
- CVSS 8.8 High
SQL injection in Tuleap
- Enalean tuleap
- SQL injection
- CVSS 6.7 Medium
Indirect LDAP injection in Tuleap
- Enalean tuleap
- Other injection
- CVSS 6.7 Medium
Indirect LDAP injection in Tuleap
- Enalean tuleap
- Other injection
- CVSS 8.8 High
SQL injection in the "SVN core" commits browser
- Enalean tuleap
- SQL injection
- CVSS 8.8 High
SQL injection in CVS revisions browser
- Enalean tuleap
- SQL injection
- CVSS 8.8 High
The update of the CI job targeted by a widget is vulnerable to blind SQL injections
- Enalean tuleap
- SQL injection