Skip to contentEnalean Tuleap vulnerabilities
- enalean tuleapTuleap is missing CSRF protection in the Overview inconsistent itemsCVE-2026-240074.6 Medium
- enalean tuleapTuleap has missing CSRF protections its in tracker field dependenciesCVE-2025-659624.6 Medium
- enalean tuleapTuleap has missing CSRF protections in its tracker trigger management systemCVE-2025-647604.6 Medium
- enalean tuleapTuleap is missing CSRF protections for its planning management APICVE-2025-644994.6 Medium
- enalean tuleapTuleap has a Cross-Site Request Forgery (CSRF) vulnerabilityCVE-2025-644984.6 Medium
- enalean tuleapTuleap exposes releases for all projects to File Release System project administratorsCVE-2025-644976.5 Medium
- enalean tuleapTuleap missing CSRF protections in the File Release SystemCVE-2025-644824.6 Medium
- enalean tuleapTuleap missing CSRF protection in the management of SVN commit rules and immutable tagsCVE-2025-641174.6 Medium
- enalean tuleapTuleap backlog item representations do not verify the permissions of the child trackersCVE-2025-590404.3 Medium
- enalean tuleapTuleap's special and always there fields permissions are not verified in cross-tracker searchCVE-2025-548775.3 Medium
- enalean tuleapTuleap exposes artifacts to a mentioned user via email notificationsCVE-2025-539024.3 Medium
- enalean tuleapTuleap is vulnerable to XSS attacks when displaying the children of a parent artifactCVE-2025-535415.4 Medium
- enalean tuleapTuleap vulnerable to user enumeration via the lost password formCVE-2025-528995.3 Medium
- enalean tuleapTuleap missing CSRF protection on tracker reports manipulationCVE-2025-501794.6 Medium
- enalean tuleapTuleap missing CSRF protection on tracker canned responses administrationCVE-2025-489914.6 Medium
- enalean tuleapTuleap does not enforce read permissions on parent trackers in the REST APICVE-2025-301554.3 Medium
- enalean tuleapTuleap has improper permission handling in the REST endpoints and release notes display of the FRS pluginCVE-2025-302095.3 Medium
- enalean tuleapTuleap allows XSS via the content of RSS feeds in the RSS widgetsCVE-2025-302034.8 Medium
- enalean tuleapTuleap is missing CSRF protection on tracker hierarchy administrationCVE-2025-299294.6 Medium
- enalean tuleapTuleap has missing CSRF protections on artifact submission & edition from the tracker viewCVE-2025-297664.6 Medium
- enalean tuleapTuleap is missing CSRF protections on tracker fields administrative operationsCVE-2025-274024.6 Medium
- enalean tuleapIn Tuleap, deleting a report can delete criteria filters in other reportsCVE-2025-274014.6 Medium
- enalean tuleapTuleap allows content injection via emails sent by the mass emailing featuresCVE-2025-271564.1 Medium
- enalean tuleapTuleap dumps the Redis password into the generated troubleshooting archivesCVE-2025-271505.3 Medium
- enalean tuleapTuleap allows XSS via the tracker names used in the semantic timeframe deletion messageCVE-2025-270994.8 Medium
- enalean tuleapTuleap allows default values to be cleared from field configurationCVE-2025-270945.4 Medium
- enalean tuleapInitial effort field does not respect field permissions in the Taskboard REST card representation in TuleapCVE-2025-221294.3 Medium
- enalean tuleapArtifact permissions are not verified in the Cross Tracker Search widget in TuleapCVE-2025-240295.3 Medium
- enalean tuleapTuleap vulnerable to XSS in the Gantt chart of the tracker pluginCVE-2024-525995.4 Medium
- enalean tuleap, tuleap enterprise +1 moreTuleap lists trackers in the quick add actions of the backlog without any permissions checkCVE-2024-477674.3 Medium
- enalean tuleapPermissions are incorrectly verified for project administrators in the cross tracker search widgetCVE-2024-477664.9 Medium
- enalean tuleap, tuleap enterprise +1 moreTuleap does not properly check permissions for email notifications in trackersCVE-2024-469884.8 Medium
- enalean tuleapTuleap vulnerable to XSS in the HTML mail content of the cross reference fieldCVE-2024-469804.8 Medium
- enalean tuleapTuleap's recursive permissions to document manager folder are not properly appliedCVE-2024-399024.8 Medium
- enalean tuleapTuleap has improper permissions of the backlog itemsCVE-2024-371674.3 Medium
- enalean tuleapTuleap deleting or moving an artifact can delete values from unrelated artifactsCVE-2024-302467.6 High
- enalean tuleapTuleap's mass update clears the permissions on artifact fieldCVE-2024-251305.4 Medium
- enalean tuleapTuleap's content of artifacts might be readable by unauthorized usersCVE-2024-233445.3 Medium
- enalean tuleapTuleap vulnerable to Cross-site Scripting on the edition page of a releaseCVE-2023-487155.4 Medium
- enalean tuleapTuleap vulnerable to Cross-site Scripting on the success message of a kanban deletionCVE-2023-395214.8 Medium
- enalean tuleapTuleap allows preview of a linked artifact with a type does not respect permissionsCVE-2023-385086.5 Medium
- enalean tuleapTuleap Cross-site Scripting vulnerability in the card field of the agile dashboard appsCVE-2023-359295.4 Medium
- enalean tuleapUser access not updated with privilege change in TuleapCVE-2023-359384.1 Medium
- enalean tuleapTuleap vulnerable toXSS via the triggered job URL of a Jenkins jobCVE-2023-320724.8 Medium
- enalean tuleapXSS in the tooltip via an artifact titleCVE-2023-306195.4 Medium
- enalean tuleapCross-site Scripting (XSS) through the name of a color of select box values in tuleapCVE-2023-239385.9 Medium
- enalean tuleapTuleap MediaWiki standalone "readers" can also edit pagesCVE-2022-234734.3 Medium
- enalean tuleapTuleap dashboards vulnerable to Incorrect AuthorizationCVE-2022-461604.3 Medium
- enalean tuleapTuleap subject to Missing Authorization allowing for branch prefix modificationCVE-2022-392334.3 Medium
- enalean tuleapFine grained permissions are not checked in TuleapCVE-2022-311285.4 Medium
- Show olderLoading…