Tuleap Cross-Site Request Forgery Vulnerability

Tuleap is an open source suite from Enalean Open Source designed to improve the management of software development and collaboration. A cross-site request forgery vulnerability exists in Tuleap Community Edition prior to 16.4.99.1740414959 and Tuleap Enterprise Edition prior to 16.4-6, and prior ...

PT-2025-9689

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 16.4.99.1740498975 Community Edition Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11 Description The issue has a limited impact in standard usage, mostly resulting in dangling data. However, a malicious...

PT-2025-9690 · Tuleap · Tuleap

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 16.4.99.1740414959 Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11 Description: The issue is related to the lack of CSRF protections on tracker fields administrative operations in Tuleap. This allows an...

CVE-2025-27402: Cross-Site Request Forgery (CSRF)

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability i...

CVE-2025-27099

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting XSS via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this...

CVE-2025-27094

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute...

CVE-2025-27099 Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting XSS via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this...

CVE-2025-27099

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting XSS via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this...

CVE-2025-27099 Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting XSS via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this...

CVE-2025-27099

Tuleap exposes an XSS vulnerability (CVE-2025-27099) in the semantic timeframe deletion message, via tracker names. The issue affects Tuleap’s tracker-name handling and can enable an administrator with a semantic timeframe used by other trackers to trick others into executing uncontrolled code. P...

CVE-2025-27099 Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting XSS via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this...

CVE-2025-27094 Tuleap allows default values to be cleared from field configuration

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute...

CVE-2025-27094

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute...

CVE-2025-27094 Tuleap allows default values to be cleared from field configuration

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute...

CVE-2025-27094 Tuleap allows default values to be cleared from field configuration

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute...

CVE-2025-27094

CVE-2025-27094 affects Tuleap Community Edition 16.4.99.1739806825–16.4.99.1739877910 and Tuleap Enterprise Edition prior to 16.3-9 or 16.4-4. The issue allows a user with tracker access to force-reset certain field configurations, leading to potential information loss; specific attributes for da...

Malicious code in @smt-front/tracker (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1700 Malicious code in @smt-front/tracker (npm)

--- -= Per source details. Do not edit below this line.=-...

Tuleap security vulnerabilities

Tuleap is an open source suite from Enalean Open Source designed to improve the management of software development and collaboration. A security vulnerability exists in Tuleap that stems from cross-site scripting in the tracker name and could lead to the execution of uncontrolled code...

CVE-2025-27094: Expected Behavior Violation

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute...