Filtered by vendor Sonatype
Subscribe
Total
43 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-17717 | 1 Sonatype | 1 Nexus Repository Manager | 2025-04-20 | 10.0 HIGH | 9.8 CRITICAL |
| Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. | |||||
| CVE-2014-9389 | 1 Sonatype | 1 Nexus | 2025-04-12 | 7.5 HIGH | N/A |
| Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors. | |||||
| CVE-2014-2034 | 1 Sonatype | 1 Nexus | 2025-04-12 | 7.5 HIGH | N/A |
| Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path." | |||||
| CVE-2014-0792 | 1 Sonatype | 1 Nexus | 2025-04-11 | 7.5 HIGH | N/A |
| Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types. | |||||
| CVE-2020-10199 | 1 Sonatype | 1 Nexus | 2025-03-14 | 9.0 HIGH | 8.8 HIGH |
| Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). | |||||
| CVE-2019-7238 | 1 Sonatype | 1 Nexus | 2025-03-07 | 7.5 HIGH | 9.8 CRITICAL |
| Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. | |||||
| CVE-2022-27907 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. | |||||
| CVE-2021-43961 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.3 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection. | |||||
| CVE-2021-43293 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF). | |||||
| CVE-2021-42568 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account. | |||||
| CVE-2021-40143 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-11-21 | 6.4 MEDIUM | 8.2 HIGH |
| Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance. | |||||
| CVE-2021-37152 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications. | |||||
| CVE-2021-34553 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access. | |||||
| CVE-2021-30635 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed). | |||||
| CVE-2021-29159 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of the NXRM application. | |||||
| CVE-2021-29158 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-11-21 | 4.0 MEDIUM | 4.9 MEDIUM |
| Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. | |||||
| CVE-2020-29436 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 5.5 MEDIUM | 6.5 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0. | |||||
| CVE-2020-24622 | 1 Sonatype | 1 Nexus | 2024-11-21 | 4.0 MEDIUM | 4.9 MEDIUM |
| In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user. | |||||
| CVE-2020-15871 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-11-21 | 6.8 MEDIUM | 8.8 HIGH |
| Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution. | |||||
| CVE-2020-15870 | 1 Sonatype | 1 Nexus Repository Manager 3 | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). | |||||