# Enalean Tuleap


- [CVE-2018-17298](https://insights.sbomify.com/CVE-2018-17298/): Business logic in n/a (critical 9.8)
- [CVE-2018-7538](https://insights.sbomify.com/CVE-2018-7538/): SQL injection in n/a (critical 9.8)
- [CVE-2014-7178](https://insights.sbomify.com/CVE-2014-7178/): Command injection in n/a (critical 9.3)
- [CVE-2021-43806](https://insights.sbomify.com/CVE-2021-43806/): SQL injection in Tuleap (high 8.8)
- [CVE-2021-41154](https://insights.sbomify.com/CVE-2021-41154/): SQL injection in the "SVN core" commits browser (high 8.8)
- [CVE-2021-41155](https://insights.sbomify.com/CVE-2021-41155/): SQL injection in CVS revisions browser (high 8.8)
- [CVE-2021-41148](https://insights.sbomify.com/CVE-2021-41148/): The update of the CI job targeted by a widget is vulnerable to blind SQL injections (high 8.8)
- [CVE-2018-7634](https://insights.sbomify.com/CVE-2018-7634/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2017-7411](https://insights.sbomify.com/CVE-2017-7411/): Deserialization in n/a (high 8.8)
- [CVE-2017-7981](https://insights.sbomify.com/CVE-2017-7981/): Command injection in n/a (high 8.8)
- [CVE-2024-30246](https://insights.sbomify.com/CVE-2024-30246/): Tuleap deleting or moving an artifact can delete values from unrelated artifacts (high 7.6)
- [CVE-2022-31058](https://insights.sbomify.com/CVE-2022-31058/): SQL injection via the field name of a tracker in Tuleap (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/products/enalean/tuleap/