Enalean vulnerabilities
62 CVEs and advisories name Enalean as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-47766Permissions are incorrectly verified for project administrators in the cross tracker search widget
- CVE-2024-46988Tuleap does not properly check permissions for email notifications in trackers
- CVE-2024-46980Tuleap vulnerable to XSS in the HTML mail content of the cross reference field
- CVE-2024-39902Tuleap's recursive permissions to document manager folder are not properly applied
- CVE-2024-37167Tuleap has improper permissions of the backlog items
- CVE-2024-30246Tuleap deleting or moving an artifact can delete values from unrelated artifacts
- CVE-2024-25130Tuleap's mass update clears the permissions on artifact field
- CVE-2024-23344Tuleap's content of artifacts might be readable by unauthorized users
- CVE-2023-48715Tuleap vulnerable to Cross-site Scripting on the edition page of a release
- CVE-2023-39521Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion
- CVE-2023-38508Tuleap allows preview of a linked artifact with a type does not respect permissions
- CVE-2023-35929Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps
- CVE-2023-35938User access not updated with privilege change in Tuleap
- CVE-2023-32072Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job
- CVE-2023-30619XSS in the tooltip via an artifact title
- CVE-2023-23938Cross-site Scripting (XSS) through the name of a color of select box values in tuleap
- CVE-2022-23473Tuleap MediaWiki standalone "readers" can also edit pages
- CVE-2022-46160Tuleap dashboards vulnerable to Incorrect Authorization
- CVE-2022-39233Tuleap subject to Missing Authorization allowing for branch prefix modification
- CVE-2022-31128Fine grained permissions are not checked in Tuleap
- CVE-2022-31058SQL injection via the field name of a tracker in Tuleap
- CVE-2022-31063Cross site scripting via the title of a document in Tuleap
- CVE-2022-31032Resources of private projects can be exposed in Tuleap
- CVE-2022-24896Tracker report renderer and chart widgets leak information in Tuleap
- CVE-2021-43806SQL injection in Tuleap
- CVE-2021-41276Indirect LDAP injection in Tuleap
- CVE-2021-43782Indirect LDAP injection in Tuleap
- CVE-2021-41154SQL injection in the "SVN core" commits browser
- CVE-2021-41155SQL injection in CVS revisions browser
- CVE-2021-41148The update of the CI job targeted by a widget is vulnerable to blind SQL injections