Enalean Tuleap any version

A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQL commands.

An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password.

Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used within PhpWiki before 1.5.5 with a syntax value in its first argument, and an authenticated Tuleap user can control this value, even with shell metacharacters, as demonstrated by a '<?plugin SyntaxHighlighter syntax="c;id"' line to execute the id command.

An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be exploited to inject arbitrary PHP objects into the application scope, allowing an attacker to perform a variety of attacks (including but not limited to Remote Code Execution).

SQL injection in Tuleap

The update of the CI job targeted by a widget is vulnerable to blind SQL injections

SQL injection in CVS revisions browser

SQL injection in the "SVN core" commits browser

Tuleap deleting or moving an artifact can delete values from unrelated artifacts

SQL injection in the planning edition panel

Indirect LDAP injection in Tuleap

SQL injection via the field name of a tracker in Tuleap

Indirect LDAP injection in Tuleap

User access not updated with privilege change in Tuleap

SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lobal_txt parameter to plugins/docman.

Cross site scripting via the title of a document in Tuleap

Tuleap allows preview of a linked artifact with a type does not respect permissions

Tuleap's content of artifacts might be readable by unauthorized users

Tuleap's mass update clears the permissions on artifact field

Tuleap dumps the Redis password into the generated troubleshooting archives

Tuleap exposes releases for all projects to File Release System project administrators

Cross-site Scripting (XSS) through the name of a color of select box values in tuleap

Tuleap does not properly check permissions for email notifications in trackers

XSS via the name of a deleted attachment

Tuleap subject to Missing Authorization allowing for branch prefix modification

Fine grained permissions are not checked in Tuleap

Tuleap vulnerable to Cross-site Scripting on the edition page of a release

XSS in the tooltip via an artifact title

Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps

Tuleap allows default values to be cleared from field configuration

Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin

Tuleap allows content injection via emails sent by the mass emailing features

Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifact

Tuleap is missing CSRF protections for its planning management API

Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin

Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap

Tuleap's special and always there fields permissions are not verified in cross-tracker search

Tuleap vulnerable to user enumeration via the lost password form

Permissions are incorrectly verified for project administrators in the cross tracker search widget