VendorsEnaleantuleapall versions

Vulnerabilities

Enalean Tuleap

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

68CVEs

Tuleap vulnerable to user enumeration via the lost password form

Published 2025-07-29 · Analyzed

5.3EPSS 0.003

Permissions are incorrectly verified for project administrators in the cross tracker search widget

Published 2024-10-14 · Analyzed

4.9EPSS 0.005

Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion

Published 2023-08-24 · Modified

4.8EPSS 0.006

Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job

Published 2023-05-29 · Modified

4.8EPSS 0.005

Tuleap vulnerable to XSS in the HTML mail content of the cross reference field

Published 2024-10-14 · Analyzed

4.8EPSS 0.004

Tuleap's recursive permissions to document manager folder are not properly applied

Published 2024-07-22 · Analyzed

4.8EPSS 0.003

Tuleap allows XSS via the content of RSS feeds in the RSS widgets

Published 2025-03-31 · Analyzed

4.8EPSS 0.003

Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message

Published 2025-03-03 · Analyzed

4.8EPSS 0.003

In Tuleap, deleting a report can delete criteria filters in other reports

Published 2025-03-04 · Analyzed

4.6EPSS 0.003

Tuleap has missing CSRF protections on artifact submission & edition from the tracker view

Published 2025-03-31 · Analyzed

4.6EPSS 0.002

Tuleap is missing CSRF protection on tracker hierarchy administration

Published 2025-03-31 · Analyzed

4.6EPSS 0.002

Tuleap missing CSRF protection on tracker canned responses administration

Published 2025-06-25 · Analyzed

4.6EPSS 0.002

Tuleap missing CSRF protection on tracker reports manipulation

Published 2025-06-25 · Analyzed

4.6EPSS 0.002

Tuleap is missing CSRF protections on tracker fields administrative operations

Published 2025-03-04 · Analyzed

4.6EPSS 0.002

Tuleap has missing CSRF protections its in tracker field dependencies

Published 2025-12-08 · Analyzed

4.6EPSS 0.002

Tuleap is missing CSRF protection in the Overview inconsistent items

Published 2026-02-02 · Analyzed

4.6EPSS 0.001

Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability

Published 2025-12-08 · Analyzed

4.6EPSS 0.001

Tuleap has missing CSRF protections in its tracker trigger management system

Published 2025-12-08 · Analyzed

4.6EPSS 0.001

Resources of private projects can be exposed in Tuleap

Published 2022-06-29 · Modified

4.3EPSS 0.010

Tracker report renderer and chart widgets leak information in Tuleap

Published 2022-06-06 · Modified

4.3EPSS 0.008

Tuleap dashboards vulnerable to Incorrect Authorization

Published 2022-12-13 · Modified

4.3EPSS 0.005

Tuleap MediaWiki standalone "readers" can also edit pages

Published 2022-12-13 · Modified

4.3EPSS 0.005

Tuleap lists trackers in the quick add actions of the backlog without any permissions check

Published 2024-10-14 · Analyzed

4.3EPSS 0.004

Tuleap has improper permissions of the backlog items

Published 2024-06-25 · Analyzed

4.3EPSS 0.004

Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap

Published 2025-02-03 · Analyzed

4.3EPSS 0.003

Tuleap does not enforce read permissions on parent trackers in the REST API

Published 2025-03-31 · Analyzed

4.3EPSS 0.003

Tuleap exposes artifacts to a mentioned user via email notifications

Published 2025-07-29 · Analyzed

4.3EPSS 0.003

XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary files via a crafted xml document in a create action to plugins/tracker/.

Published 2014-10-31 · Modified

4.01 PoCEPSS 0.033