849 matches found
Tuleap Detection (HTTP)
HTTP based detection of Tuleap. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.106378";...
Tuleap < 8.19.99.5 Multiple Vulnerabilities
Tuleap is prone to multiple vulnerabilities. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Tuleap PHP Unserialize Code Execution (CVE-2014-8791)
This module exploits a PHP object injection vulnerability. Tuelap could be abused to allow authenticated users to execute arbitrary code with the permissions of the web server. This could lead to execute PHP code on the server...
Tuleap - PHP Unserialize Code Execution (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Tuleap PHP Unserialize Code Execution', 'Description' = %q This module exploits a PHP object injection vulnerability in Tuelap...
CVE-2014-8791
project/register.php in Tuleap before 7.7, when syscreateprojectinonestep is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter...
Design/Logic Flaw
project/register.php in Tuleap before 7.7, when syscreateprojectinonestep is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter...
CVE-2014-8791
project/register.php in Tuleap before 7.7, when syscreateprojectinonestep is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter...
CVE-2014-8791
project/register.php in Tuleap before 7.7, when syscreateprojectinonestep is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter...
CVE-2014-8791
CVE-2014-8791 affects Tuleap up to version 7.6-4. The vulnerability resides in the /src/www/project/register.php path where the data parameter is unserialized, allowing PHP object injection and potential arbitrary code execution when sys_create_project_in_one_step is disabled. The issue requires ...
PT-2014-8733
Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 7.7 Description The issue allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter in the project/register.php file when sys create project in one...
CVE-2014-8791: Improper Control of Generation of Code
project/register.php in Tuleap before 7.7, when syscreateprojectinonestep is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter...
[KIS-2014-13] Tuleap <= 7.6-4 (register.php) PHP Object Injection Vulnerability
----------------------------------------------------------------- Tuleap = 7.6-4 register.php PHP Object Injection Vulnerability ----------------------------------------------------------------- - Software Links: https://www.tuleap.org/ https://www.enalean.com/ - Affected Versions: Version 7.6-4...
Tuleap 7.6-4 PHP Object Injection Vulnerability
Tuleap versions 7.6-4 and below suffer from a PHP object injection vulnerability in register.php...
Design/Logic Flaw
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function...
CVE-2014-7178
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function...
CVE-2014-7178
Enalean Tuleap prior to 7.5 (listed variants include 7.4.99.5 and earlier; fixed in 7.5) is vulnerable to remote command execution via the User-Agent header passed to the passthru PHP function (via the SVN handler page). This is triggered by crafted requests such as /svn/viewvc.php/?roottype=svn&...
CVE-2014-7178
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function...
Tuleap 7.6-4 PHP Object Injection
----------------------------------------------------------------- Tuleap route$request; 35. exit; 36. 37. 38. $currentstep = $request-exist'currentstep' ? $request-get'currentstep' : 0; 39. $data = $request-exist'data' ? unserialize$request-get'data' : array; User input passed through the "data"...
PT-2014-7817
Name of the Vulnerable Software and Affected Versions Enalean Tuleap versions prior to 7.5.99.6 Description The issue allows remote attackers to execute arbitrary commands. This is achieved by manipulating the User-Agent header, which is then provided to the passthru PHP function. Recommendations...
CVE-2014-7178: Improper Input Validation
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function...