CVE-2019-10085

The CVE-2019-10085 entry concerns Apache Allura versions prior to 1.11.0 with a stored XSS vulnerability in the user dropdown selector on the ticket creation/editing page. The issue arises from the vulnerability existing on that UI element, enabling malicious input to be stored and potentially ex...

CVE-2018-1299

In Apache Allura, CVE-2018-1299 affects Allura versions prior to 1.8.0. Unauthenticated attackers can retrieve arbitrary files via the Allura web application; some web servers (e.g., Nginx, Apache/mod_wsgi, paster) may mitigate, while others (e.g., gunicorn) do not. Mitigation is to upgrade to Al...

CVE-2026-69223

CVE-2026-69223 affects Apache Allura prior to 1.19.1, where the webhooks are vulnerable to Server-Side Request Forgery (SSRF). The issue is rooted in the webhook handling in Allura, with the impact described as high confidentiality and integrity risk but no availability impact, and a network-expl...

CVE-2026-73240

CVE-2026-73240 affects Apache Allura (before 1.19.1) and involves git command injection via specially crafted inputs. The issue is resolved by upgrading to Allura 1.19.1. This entry is supported by multiple sources in the connected documents, including NVD and CVE records, which explicitly state ...

CVE-2026-73238

Apache Allura contains an XSS in code display vulnerability (CVE-2026-73238) affecting versions before 1.19.1. The issue is addressed by upgrading to Allura 1.19.1. The provided metrics indicate a CVSSv3.1 base score of 6.1 (Medium) with network attack vector, low confidentiality/integrity impact...

CVE-2026-73239

CVE-2026-73239 : In Apache Allura, an Insecure Direct Object Reference (IDOR) arises from missing permission checks for multiple Artifact types. Affected versions: before 1.19.1. The advisory recommends upgrading to version 1.19.1 to fix the issue. The available sources consistently describe the ...