CVE-2014-7177

XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary files via a crafted xml document in a create action to plugins/tracker/.

• http://seclists.org/fulldisclosure/2014/Oct/120Exploit
• http://www.osvdb.org/113680
• http://www.securityfocus.com/bid/70771
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98308
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=blob&h=aed26cbae81410a981c4615bd7da1518f31c50d0&hb=29cbe3557a07c74f3d910648b8c5307e8faef65a&f=ChangeLog
• https://tuleap.net/plugins/tracker/?aid=7458Vendor Advisory
• https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7177/Exploit
• https://www.tuleap.org/recent-vulnerabilitiesVendor Advisory
• http://seclists.org/fulldisclosure/2014/Oct/120Exploit
• http://www.osvdb.org/113680
• http://www.securityfocus.com/bid/70771
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98308
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=blob&h=aed26cbae81410a981c4615bd7da1518f31c50d0&hb=29cbe3557a07c74f3d910648b8c5307e8faef65a&f=ChangeLog
• https://tuleap.net/plugins/tracker/?aid=7458Vendor Advisory
• https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7177/Exploit
• https://www.tuleap.org/recent-vulnerabilitiesVendor Advisory

Published

Oct 31, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-7169GNU Bash through 4.3 bash43-025 processes trailing strings a…9.8
• CVE-2014-7170Race condition in Puppet Server 0.2.0 allows local users to …
• CVE-2014-7173FarLinX X25 Gateway through 2014-09-25 allows command inject…9.8
• CVE-2014-7174FarLinX X25 Gateway through 2014-09-25 allows directory trav…5.3
• CVE-2014-7175FarLinX X25 Gateway through 2014-09-25 allows attackers to w…9.8
• CVE-2014-7176SQL injection vulnerability in Enalean Tuleap before 7.5.99.…
• CVE-2014-7178Enalean Tuleap before 7.5.99.6 allows remote attackers to ex…
• CVE-2014-7180Electric Cloud ElectricCommander before 4.2.6 and 5.x before…
• CVE-2014-7181Cross-site scripting (XSS) vulnerability in the Max Foundry …
• CVE-2014-7182Multiple cross-site scripting (XSS) vulnerabilities in the W…
• CVE-2014-7183Multiple cross-site scripting (XSS) vulnerabilities in the s…
• CVE-2014-7185Integer overflow in bufferobject.c in Python before 2.7.8 al…