Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Enalean — Vulnerabilities & Security Advisories 62

Browse all 62 CVE security advisories affecting Enalean. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Enalean develops enterprise software solutions, primarily known for the Bugzilla bug tracking system and the Phabricator suite, which facilitate project management and code review for large-scale technical organizations. Historically, vulnerabilities within these platforms have frequently involved cross-site scripting (XSS), SQL injection, and improper access control mechanisms that could lead to privilege escalation. The high volume of recorded Common Vulnerabilities and Exposures (CVEs) reflects the complexity of these web-based applications and the rigorous scrutiny applied to their codebases. While no single catastrophic breach has defined the company’s public security history, the persistent nature of these flaws underscores the challenges inherent in maintaining secure, feature-rich collaboration tools. Security updates are regularly deployed to address these issues, emphasizing the need for administrators to maintain strict patching schedules to mitigate risks associated with unpatched instances.

Found 62 results / 62 Clear Filters
Top products by Enalean: tuleap
CVE ID Title CVSS Severity Published
CVE-2024-47766 Permissions are incorrectly verified for project administrators in the cross tracker search widget — tuleap CWE-280 4.9 Medium 2024-10-14
CVE-2024-46988 Tuleap does not properly check permissions for email notifications in trackers — tuleap CWE-280 4.8 Medium 2024-10-14
CVE-2024-46980 Tuleap vulnerable to XSS in the HTML mail content of the cross reference field — tuleap CWE-79 4.8 Medium 2024-10-14
CVE-2024-39902 Tuleap's recursive permissions to document manager folder are not properly applied — tuleap CWE-281 4.8 Medium 2024-07-22
CVE-2024-37167 Tuleap has improper permissions of the backlog items — tuleap CWE-285 4.3 Medium 2024-06-25
CVE-2024-30246 Tuleap deleting or moving an artifact can delete values from unrelated artifacts — tuleap CWE-440 7.6 High 2024-03-29
CVE-2024-25130 Tuleap's mass update clears the permissions on artifact field — tuleap CWE-200 5.4 Medium 2024-02-22
CVE-2024-23344 Tuleap's content of artifacts might be readable by unauthorized users — tuleap CWE-200 5.3 Medium 2024-02-06
CVE-2023-48715 Tuleap vulnerable to Cross-site Scripting on the edition page of a release — tuleap CWE-79 5.4 Medium 2023-12-11
CVE-2023-39521 Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion — tuleap CWE-79 4.8 Medium 2023-08-24
CVE-2023-38508 Tuleap allows preview of a linked artifact with a type does not respect permissions — tuleap CWE-285 6.5 Medium 2023-08-24
CVE-2023-35929 Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps — tuleap CWE-79 5.4 Medium 2023-07-25
CVE-2023-35938 User access not updated with privilege change in Tuleap — tuleap CWE-281 4.1 Medium 2023-06-29
CVE-2023-32072 Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job — tuleap CWE-79 4.8 Medium 2023-05-29
CVE-2023-30619 XSS in the tooltip via an artifact title — tuleap CWE-79 5.4 Medium 2023-05-04
CVE-2023-23938 Cross-site Scripting (XSS) through the name of a color of select box values in tuleap — tuleap CWE-79 5.9 Medium 2023-04-20
CVE-2022-23473 Tuleap MediaWiki standalone "readers" can also edit pages — tuleap CWE-863 4.3 Medium 2022-12-13
CVE-2022-46160 Tuleap dashboards vulnerable to Incorrect Authorization — tuleap CWE-863 4.3 Medium 2022-12-13
CVE-2022-39233 Tuleap subject to Missing Authorization allowing for branch prefix modification — tuleap CWE-862 4.3 Medium 2022-10-19
CVE-2022-31128 Fine grained permissions are not checked in Tuleap — tuleap CWE-862 5.4 Medium 2022-08-01
CVE-2022-31058 SQL injection via the field name of a tracker in Tuleap — tuleap CWE-89 7.2 High 2022-06-29
CVE-2022-31063 Cross site scripting via the title of a document in Tuleap — tuleap CWE-79 6.5 Medium 2022-06-29
CVE-2022-31032 Resources of private projects can be exposed in Tuleap — tuleap CWE-200 4.3 Medium 2022-06-29
CVE-2022-24896 Tracker report renderer and chart widgets leak information in Tuleap — tuleap CWE-862 4.3 Medium 2022-06-06
CVE-2021-43806 SQL injection in Tuleap — tuleap CWE-89 8.8 High 2021-12-15
CVE-2021-41276 Indirect LDAP injection in Tuleap — tuleap CWE-74 6.7 Medium 2021-12-15
CVE-2021-43782 Indirect LDAP injection in Tuleap — tuleap CWE-90 6.7 Medium 2021-12-15
CVE-2021-41154 SQL injection in the "SVN core" commits browser — tuleap CWE-89 8.8 High 2021-10-18
CVE-2021-41155 SQL injection in CVS revisions browser — tuleap CWE-89 8.8 High 2021-10-18
CVE-2021-41148 The update of the CI job targeted by a widget is vulnerable to blind SQL injections — tuleap CWE-89 8.8 High 2021-10-15

This page lists every published CVE security advisory associated with Enalean. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.