Product by Enalean

    Enalean Tuleap

    71 known vulnerabilities in Enalean Tuleap (Enalean), 0 of them actively exploited (CISA KEV).

    Key figures

    71

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Enalean Tuleap (Enalean)
    HighCVE-2017-7411

    Enalean Tuleap: Remote Code Execution

    		8.8
    HighCVE-2017-7981

    Enalean Tuleap: Command Injection

    		8.8
    CriticalCVE-2018-7538

    Enalean Tuleap: SQL Injection

    		9.8
    CriticalCVE-2018-17298

    Enalean Tuleap: security vulnerability

    		9.8
    HighCVE-2021-43806

    SQL injection in Tuleap

    		8.8
    HighCVE-2021-41154

    SQL injection in the "SVN core" commits browser

    		8.8
    HighCVE-2021-41155

    SQL injection in CVS revisions browser

    		8.8
    HighCVE-2021-41148

    The update of the CI job targeted by a widget is vulnerable to blind SQL injections

    		8.8
    HighCVE-2021-41147

    SQL injection in the planning edition panel

    		7.2
    HighCVE-2022-31058

    SQL injection via the field name of a tracker in Tuleap

    		7.2
    HighCVE-2021-41276

    Indirect LDAP injection in Tuleap

    		6.7
    HighCVE-2021-43782

    Indirect LDAP injection in Tuleap

    		6.7
    Not ratedCVE-2014-8791

    Enalean Tuleap: security vulnerability

    		—
    HighCVE-2018-7634

    Enalean Tuleap: Cross-Site Request Forgery (CSRF)

    		8.8
    Not ratedCVE-2014-7178

    Enalean Tuleap: security vulnerability

    		—
    Not ratedCVE-2014-7177

    Enalean Tuleap: XML External Entity (XXE)

    		—
    HighCVE-2024-30246

    Tuleap deleting or moving an artifact can delete values from unrelated artifacts

    		7.6
    MediumCVE-2023-38508

    Tuleap allows preview of a linked artifact with a type does not respect permissions

    		6.5
    MediumCVE-2022-31063

    Cross site scripting via the title of a document in Tuleap

    		6.5
    Not ratedCVE-2014-7176

    Enalean Tuleap: SQL Injection

    		—
    MediumCVE-2022-31032

    Resources of private projects can be exposed in Tuleap

    		4.3
    MediumCVE-2021-41142

    XSS via the name of a deleted attachment

    		5.4
    MediumCVE-2022-31128

    Fine grained permissions are not checked in Tuleap

    		5.4
    MediumCVE-2022-39233

    Tuleap subject to Missing Authorization allowing for branch prefix modification

    		4.3
    MediumCVE-2025-64497

    Tuleap exposes releases for all projects to File Release System project administrators

    		6.5

    All vulnerabilities in search

    All products by Enalean