Lucene search

K

Sonarqube Security Vulnerabilities

cve
cve

CVE-2020-35193

The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank...

9.8CVSS

9.5AI Score

0.007EPSS

2020-12-16 12:15 AM
49
4
cve
cve

CVE-2020-28002

In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit...

5.3CVSS

5.5AI Score

0.001EPSS

2020-11-02 09:15 PM
17
cve
cve

CVE-2020-27986

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure...

7.5CVSS

7.4AI Score

0.369EPSS

2020-10-28 11:15 PM
50
cve
cve

CVE-2019-17579

SonarSource SonarQube before 7.8 has XSS in project links on...

6.1CVSS

5.9AI Score

0.001EPSS

2019-10-14 03:15 PM
51
cve
cve

CVE-2018-1000425

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to...

7.8CVSS

7.3AI Score

0.0004EPSS

2019-01-09 11:29 PM
28
cve
cve

CVE-2018-19413

A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the...

4.3CVSS

4.3AI Score

0.001EPSS

2018-12-14 03:29 PM
45
cve
cve

CVE-2013-5676

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from...

5.7AI Score

0.013EPSS

2013-12-13 06:55 PM
21