Apache Allura: Git command injection

Apache Allura: Server-side request forgery

Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura…

In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application

Apache Allura: Missing permission checks IDOR

Apache Allura: XSS in markdown pipeline

Apache Allura: XSS in code display

In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets

In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting

Apache Allura: Unauthenticated REST disclosure

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.  Only neighborhood admins can access these settings, so the scope of risk is limited to configurations…