Filtered by vendor Sonarsource Subscriptions
Total 10 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-38460 1 Sonarsource 1 Sonarqube 2024-11-21 4.9 Medium
In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).
CVE-2020-35193 1 Sonarsource 1 Sonarqube Docker Image 2024-11-21 9.8 Critical
The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVE-2020-28002 1 Sonarsource 1 Sonarqube 2024-11-21 5.3 Medium
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint.
CVE-2020-27986 1 Sonarsource 1 Sonarqube 2024-11-21 7.5 High
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.
CVE-2019-17579 1 Sonarsource 1 Sonarqube 2024-11-21 6.1 Medium
SonarSource SonarQube before 7.8 has XSS in project links on account/projects.
CVE-2018-19413 1 Sonarsource 1 Sonarqube 2024-11-21 N/A
A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
CVE-2018-1000425 1 Sonarsource 1 Sonarqube Scanner 2024-11-21 N/A
An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.
CVE-2013-5676 1 Sonarsource 2 Jenkins Plugin, Sonarqube 2024-11-21 N/A
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
CVE-2024-47911 1 Sonarsource 1 Sonarqube 2024-10-07 6.7 Medium
In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands.
CVE-2024-47910 1 Sonarsource 1 Sonarqube 2024-10-07 7.2 High
An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT.