| CVE-2026-92120 |
OAuth1 Request Replay Attack vulnerability in Apache Allura
|
Not rated
|
Oct 12, 2026 |
| CVE-2026-92119 |
REST API Mass Assignment vulnerability in Apache Allura
|
Not rated
|
Oct 12, 2026 |
| CVE-2026-92116 |
OAuth1 callback validation vulnerability in Apache Allura
|
Not rated
|
Oct 12, 2026 |
| CVE-2026-80190 |
Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The…
|
Not rated
|
Sep 4, 2026 |
| CVE-2026-81270 |
Apache Allura: exposure of non-public information via search
|
Not rated
|
Sep 4, 2026 |
| CVE-2026-80181 |
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF)
|
Not rated
|
Sep 4, 2026 |
| CVE-2026-80180 |
Stored XSS via markdown HTML processing in Apache Allura
|
Not rated
|
Sep 4, 2026 |
| CVE-2026-75099 |
Unauthenticated REST disclosure of certain content items in Apache Allura
|
Not rated
|
Aug 24, 2026 |
| CVE-2026-73237 |
XSS vulnerability in Markdown handling in Apache Allura
|
Not rated
|
Aug 12, 2026 |
| CVE-2026-73238 |
XSS vulnerability in code display in Apache Allura
|
Not rated
|
Aug 12, 2026 |
| CVE-2026-73239 |
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura
|
Not rated
|
Aug 12, 2026 |
| CVE-2026-73240 |
Specifically crafted inputs may lead to git argument injection in Apache Allura
|
Not rated
|
Aug 12, 2026 |
| CVE-2026-69223 |
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF)
|
Not rated
|
Aug 11, 2026 |
| CVE-2024-38379 |
Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access…
|
Not rated
|
Jun 22, 2024 |
| CVE-2024-36471 |
Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project…
|
Not rated
|
Jun 10, 2024 |
| CVE-2023-46851 |
Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments
|
Not rated
|
Nov 7, 2023 |
| CVE-2018-1319 |
In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting
|
Not rated
|
Mar 15, 2018 |
| CVE-2018-1299 |
In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application
|
Not rated
|
Feb 6, 2018 |