Skip to content
Noroxi

Enalean records

68 published records for vendor enalean.

Researcher profile

Entered KEV
0 · 0%
Weaponized
2 · 2.9%
Pre-auth RCE
2
With a fix record
5.9%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

68 records
  • CVE-2017-7411
    55Plan

    An issue was discovered in Enalean Tuleap 9.6 and prior versions.

    HighCVSS 8.8WeaponizedEPSS 66%

    enalean · tuleapOct 30, 2017

  • CVE-2017-7981
    40Plan

    Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin.

    HighCVSS 8.8Proof of conceptEPSS 16%

    enalean · tuleapApr 29, 2017

  • CVE-2014-8791
    40Plan

    project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP

    MediumCVSS 6.0WeaponizedEPSS 14%

    enalean · tuleapDec 1, 2014

  • CVE-2018-7538
    40Plan

    A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to e

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    enalean · tuleapMar 12, 2018

  • CVE-2018-17298
    40Plan

    An issue was discovered in Enalean Tuleap before 10.5.

    CriticalCVSS 9.8No exploitEPSS 1%

    enalean · tuleapSep 21, 2018

  • CVE-2014-7178
    39Monitor

    Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the pas

    CriticalCVSS 9.3Proof of conceptEPSS 5%

    enalean · tuleapNov 28, 2014

  • CVE-2021-43806
    35Monitor

    SQL injection in Tuleap

    HighCVSS 8.8No exploitEPSS 1%

    enalean · tuleapDec 15, 2021

  • CVE-2021-41148
    35Monitor

    The update of the CI job targeted by a widget is vulnerable to blind SQL injections

    HighCVSS 8.8No exploitEPSS 1%

    enalean · tuleapOct 15, 2021

  • CVE-2021-41154
    35Monitor

    SQL injection in the "SVN core" commits browser

    HighCVSS 8.8No exploitEPSS 1%

    enalean · tuleapOct 18, 2021

  • CVE-2021-41155
    35Monitor

    SQL injection in CVS revisions browser

    HighCVSS 8.8No exploitEPSS 1%

    enalean · tuleapOct 18, 2021

  • CVE-2018-7634
    35Monitor

    An issue was discovered in Enalean Tuleap 9.17.

    HighCVSS 8.8No exploitEPSS 0%

    enalean · tuleapMar 1, 2018

  • CVE-2021-41147
    29Monitor

    SQL injection in the planning edition panel

    HighCVSS 7.2No exploitEPSS 1%

    enalean · tuleapOct 15, 2021

  • CVE-2021-41276
    28Monitor

    Indirect LDAP injection in Tuleap

    HighCVSS 7.2No exploitEPSS 1%

    enalean · tuleapDec 15, 2021

  • CVE-2022-31058
    28Monitor

    SQL injection via the field name of a tracker in Tuleap

    HighCVSS 7.2No exploitEPSS 1%

    enalean · tuleapJun 29, 2022

  • CVE-2021-43782
    28Monitor

    Indirect LDAP injection in Tuleap

    HighCVSS 7.2No exploitEPSS 1%

    enalean · tuleapDec 15, 2021

  • CVE-2024-30246
    28Monitor

    Tuleap deleting or moving an artifact can delete values from unrelated artifacts

    HighCVSS 7.1No exploitEPSS 0%

    enalean · tuleapMar 29, 2024

  • CVE-2023-35938
    28Monitor

    User access not updated with privilege change in Tuleap

    HighCVSS 7.2No exploitEPSS 0%

    enalean · tuleapJun 29, 2023

  • CVE-2014-7176
    27Monitor

    SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lo

    MediumCVSS 6.5Proof of conceptEPSS 2%

    enalean · tuleapNov 4, 2014

  • CVE-2024-23344
    26Monitor

    Tuleap's content of artifacts might be readable by unauthorized users

    MediumCVSS 6.5No exploitEPSS 0%

    enalean · tuleapFeb 6, 2024

  • CVE-2024-25130
    26Monitor

    Tuleap's mass update clears the permissions on artifact field

    MediumCVSS 6.5No exploitEPSS 0%

    enalean · tuleapFeb 22, 2024

  • CVE-2025-27150
    26Monitor

    Tuleap dumps the Redis password into the generated troubleshooting archives

    MediumCVSS 6.5No exploitEPSS 0%

    enalean · tuleapMar 4, 2025

  • CVE-2025-64497
    26Monitor

    Tuleap exposes releases for all projects to File Release System project administrators

    MediumCVSS 6.5No exploitEPSS 0%

    enalean · tuleapDec 8, 2025

  • CVE-2024-46988
    22Monitor

    Tuleap does not properly check permissions for email notifications in trackers

    MediumCVSS 5.7No exploitEPSS 0%

    enalean · tuleapOct 14, 2024

  • CVE-2022-39233
    21Monitor

    Tuleap subject to Missing Authorization allowing for branch prefix modification

    MediumCVSS 5.4No exploitEPSS 0%

    enalean · tuleapOct 19, 2022

  • CVE-2021-41142
    21Monitor

    XSS via the name of a deleted attachment

    MediumCVSS 5.4No exploitEPSS 0%

    enalean · tuleapOct 14, 2021