CVE-2019-10085

The CVE-2019-10085 entry concerns Apache Allura versions prior to 1.11.0 with a stored XSS vulnerability in the user dropdown selector on the ticket creation/editing page. The issue arises from the vulnerability existing on that UI element, enabling malicious input to be stored and potentially ex...

CVE-2024-36471

Apache Allura versions 1.0.1 through 1.16.0 are vulnerable to DNS rebinding attacks within the import functionality. The root cause is a security gap between the verification and processing of the URL, which could allow project administrators to trigger imports that cause the platform to read fro...

CVE-2024-38379

CVE-2024-38379 affects Apache Allura (versions 1.4.0–1.17.0). The vulnerability is a stored XSS in the neighborhood settings, accessible only to neighborhood admins, limiting scope to configurations where admins aren’t fully trusted. Root cause is unfiltered/unsafely handled user data in these se...

CVE-2018-1299

In Apache Allura, CVE-2018-1299 affects Allura versions prior to 1.8.0. Unauthenticated attackers can retrieve arbitrary files via the Allura web application; some web servers (e.g., Nginx, Apache/mod_wsgi, paster) may mitigate, while others (e.g., gunicorn) do not. Mitigation is to upgrade to Al...

CVE-2018-1319

CVE-2018-1319 affects Apache Allura before 1.8.1. The issue arises from attackers crafting URLs that trigger HTTP response splitting, potentially enabling XSS or DoS for victims. Connected sources confirm the affected product (Allura) and the vulnerable condition (pre-1.8.1) with the same impact ...

CVE-2026-73240

Apache Allura versions prior to 1.19.1 are vulnerable to git argument injection . This flaw occurs when specifically crafted inputs allow an attacker to insert unauthorized arguments into a git command executed by the application. The impact is severe, with a CVSS score of 9.8 , indicating high c...

CVE-2023-46851

CVE-2023-46851 affects Apache Allura 1.0.1–1.15.0, caused by importing attachments without restricting URL values, enabling reading of local files. This exposes internal files and can lead to exploits such as session hijacking or remote code execution. A fix is available in Allura 1.16.0. If upgr...

CVE-2026-69223

Apache Allura versions prior to 1.19.1 are vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) flaw within its webhooks functionality. An attacker can exploit this vulnerability to induce the server-side application to make arbitrary requests to unintended locations, such as internal net...

CVE-2026-73238

A Cross-Site Scripting (XSS) vulnerability exists in the code display feature of Apache Allura . This flaw affects versions before 1.19.1 . The vulnerability allows for the improper neutralization of script-related HTML tags, potentially leading to script execution in the user's browser. To remed...

CVE-2026-73237

An XSS vulnerability exists in the Markdown handling pipeline of Apache Allura . This flaw affects versions from 1.10.0 before 1.19.1 . The vulnerability allows for the improper neutralization of script-related HTML tags in a web page. To remediate this issue, users are recommended to upgrade to ...

CVE-2026-73239

Apache Allura versions prior to 1.19.1 are vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is missing permission checks for multiple Artifact types , allowing unauthorized access to objects based on user-supplied input without sufficient authorization verification. To re...

CVE-2026-75099

Apache Allura versions through 1.19.1 are vulnerable to an unauthenticated REST disclosure of certain content items. This vulnerability allows an unauthorized actor to access sensitive information via the REST interface. Users are recommended to upgrade to version 1.20.0 , which contains the fix ...