CVE-2023-35929

Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tuleap Community Edition and prior to versions 14.10-2 and 14.9-5 of Tuleap Enterprise Edition, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. A malicious user with the capability to create an artifact or to edit a field used as a card field could force victim to execute uncontrolled code. Tuleap Community Edition 14.10.99.4, Tuleap Enterprise Edition 14.10-2, and Tuleap Enterprise Edition 14.9-5 contain a fix.

• CWE-79

• https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188dPatch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188dPatch
• https://tuleap.net/plugins/tracker/?aid=32629Vendor Advisory
• https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188dPatch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188dPatch
• https://tuleap.net/plugins/tracker/?aid=32629Vendor Advisory

Published

Jul 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35921A vulnerability has been identified in SIMATIC MV540 H (All …7.5
• CVE-2023-35924GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-35925FastAsyncWorldEdit (FAWE) is designed for efficient world ed…5.5
• CVE-2023-35926Backstage is an open platform for building developer portals…9.9
• CVE-2023-35927NextCloud Server and NextCloud Enterprise Server provide fil…8.1
• CVE-2023-35928Nextcloud Server is a space for data storage on Nextcloud, a…8.8
• CVE-2023-3593Mattermost fails to properly validate markdown, allowing an …6.5
• CVE-2023-35930SpiceDB is an open source, Google Zanzibar-inspired, databas…5.3
• CVE-2023-35931Shescape is a simple shell escape library for JavaScript. An…4.3
• CVE-2023-35932jcvi is a Python library to facilitate genome assembly, anno…8.8
• CVE-2023-35933OPenFGA is an open source authorization/permission engine bu…7.5
• CVE-2023-35934yt-dlp is a command-line program to download videos from vid…8.2