Total
27 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-27907 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. | |||||
| CVE-2021-43961 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 4.3 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection. | |||||
| CVE-2021-43293 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF). | |||||
| CVE-2021-42568 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account. | |||||
| CVE-2021-30635 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed). | |||||
| CVE-2021-34553 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access. | |||||
| CVE-2021-29159 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of the NXRM application. | |||||
| CVE-2021-37152 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications. | |||||
| CVE-2020-29436 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 5.5 MEDIUM | 6.5 MEDIUM |
| Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0. | |||||
| CVE-2020-15012 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 7.8 HIGH | 8.6 HIGH |
| A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to). | |||||
| CVE-2020-11415 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 4.0 MEDIUM | 4.9 MEDIUM |
| An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext. | |||||
| CVE-2020-15868 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 5.0 MEDIUM | 7.5 HIGH |
| Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control. | |||||
| CVE-2019-15588 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 9.0 HIGH | 7.2 HIGH |
| There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability. | |||||
| CVE-2019-15893 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 6.5 MEDIUM | 7.2 HIGH |
| Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution. | |||||
| CVE-2019-16530 | 1 Sonatype | 2 Nexus Iq Server, Nexus Repository Manager | 2023-12-10 | 9.0 HIGH | 7.2 HIGH |
| Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution. | |||||
| CVE-2019-14469 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS. | |||||
| CVE-2019-5475 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 9.0 HIGH | 8.8 HIGH |
| The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability. | |||||
| CVE-2019-9629 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials). | |||||
| CVE-2019-9630 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 5.0 MEDIUM | 7.5 HIGH |
| Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images. | |||||
| CVE-2019-11629 | 1 Sonatype | 1 Nexus Repository Manager | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS. | |||||