Filtered by vendor Sonatype
Subscriptions
Total
43 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-24622 | 1 Sonatype | 1 Nexus | 2024-08-04 | 4.9 Medium |
| In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user. | ||||
| CVE-2020-15870 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-08-04 | 6.1 Medium |
| Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). | ||||
| CVE-2020-15871 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-08-04 | 8.8 High |
| Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution. | ||||
| CVE-2020-15868 | 1 Sonatype | 1 Nexus Repository Manager | 2024-08-04 | 7.5 High |
| Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control. | ||||
| CVE-2020-15869 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-08-04 | 5.4 Medium |
| Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). | ||||
| CVE-2020-15012 | 1 Sonatype | 1 Nexus Repository Manager | 2024-08-04 | 8.6 High |
| A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to). | ||||
| CVE-2020-11753 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-08-04 | 8.8 High |
| An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable). | ||||
| CVE-2020-11415 | 1 Sonatype | 1 Nexus Repository Manager | 2024-08-04 | 4.9 Medium |
| An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext. | ||||
| CVE-2020-11444 | 1 Sonatype | 1 Nexus | 2024-08-04 | 8.8 High |
| Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control. | ||||
| CVE-2020-10199 | 1 Sonatype | 1 Nexus | 2024-08-04 | 8.8 High |
| Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). | ||||
| CVE-2020-10203 | 1 Sonatype | 1 Nexus | 2024-08-04 | 4.8 Medium |
| Sonatype Nexus Repository before 3.21.2 allows XSS. | ||||
| CVE-2020-10204 | 1 Sonatype | 1 Nexus | 2024-08-04 | 7.2 High |
| Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. | ||||
| CVE-2021-43961 | 1 Sonatype | 1 Nexus Repository Manager | 2024-08-04 | 4.3 Medium |
| Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection. | ||||
| CVE-2021-43293 | 1 Sonatype | 1 Nexus Repository Manager | 2024-08-04 | 4.3 Medium |
| Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF). | ||||
| CVE-2021-42568 | 1 Sonatype | 1 Nexus Repository Manager | 2024-08-04 | 4.3 Medium |
| Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account. | ||||
| CVE-2021-40143 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-08-04 | 8.2 High |
| Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance. | ||||
| CVE-2021-37152 | 1 Sonatype | 1 Nexus Repository Manager | 2024-08-04 | 5.4 Medium |
| Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications. | ||||
| CVE-2021-34553 | 1 Sonatype | 1 Nexus Repository Manager | 2024-08-04 | 4.3 Medium |
| Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access. | ||||
| CVE-2021-30635 | 1 Sonatype | 1 Nexus Repository Manager | 2024-08-03 | 5.3 Medium |
| Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed). | ||||
| CVE-2021-29158 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-08-03 | 4.9 Medium |
| Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. | ||||