72 matches found
Gradle 安全漏洞
Gradle is the U.S. Gradle company's set of JVM-based project build tool , it supports maven, Ivy repository and so on. Gradle Enterprise prior to 2021.4.2 suffers from a security vulnerability that stems from the default built-in build cache configuration allowing anonymous write access. If this...
PT-2022-17242 · Gradle · Gradle Enterprise
Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions prior to 2021.4.2 Description: The default built-in build cache configuration in Gradle Enterprise allowed anonymous write access, potentially enabling a malicious actor with network access to populate the cache wit...
CVE-2022-25364: Incorrect Default Permissions
In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute malicious code as par...
PT-2022-16112
Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier Description The issue occurs when building an XLA compilation cache with default settings,...
CVE-2021-41589
In Gradle Enterprise before 2021.3 and Enterprise Build Cache Node before 10.0, there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymo...
Default configuration
In Gradle Enterprise before 2021.3 and Enterprise Build Cache Node before 10.0, there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymo...
CVE-2021-41589
In Gradle Enterprise before 2021.3 and Enterprise Build Cache Node before 10.0, there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymo...
CVE-2021-41589
Affected software: Gradle Enterprise prior to 2021.3 and Enterprise Build Cache Node prior to 10.0. Vulnerability: Default configuration allows anonymous access to the configuration UI and anonymous write access to the build cache, enabling cache poisoning that may execute malicious code in a bui...
CVE-2021-41589: Incorrect Permission Assignment for Critical Resource
In Gradle Enterprise before 2021.3 and Enterprise Build Cache Node before 10.0, there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymo...
PT-2021-23352
Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2021.3 Enterprise Build Cache Node versions prior to 10.0 Description The issue concerns potential cache poisoning and remote code execution when running the build cache node with its default configuration,...
Gradle 安全漏洞
Gradle is a set of JVM-based project build tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle Enterprise that stems from Potential cache poisoning and remote code execution in Gradle Enterprise prior to 2021.3 and Enterprise Build...
Gradle Enterprise Cross-Site Request Forgery Vulnerability (CNVD-2020-54143)
Gradle is a set of JVM-based project build tools , it supports maven, Ivy repository and so on. A cross-site request forgery vulnerability exists in Gradle Enterprise version 2018.2 and Build Cache Node version 4.1. The vulnerability stems from a WEB application that does not adequately validate...
Design/Logic Flaw
An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows remote attacker to bypass CSRF mitigation...
Design/Logic Flaw
An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2. Unrestricted HTTP header reflection in Gradle Enterprise allows remote attackers to obtain authentication cookies, if they are able to discover a separate XSS vulnerability. This...
CVE-2020-15771
An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows remote attacker to bypass CSRF mitigation...
CVE-2020-15768: Undefined Security Weakness
An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2. Unrestricted HTTP header reflection in Gradle Enterprise allows remote attackers to obtain authentication cookies, if they are able to discover a separate XSS vulnerability. This...
CVE-2020-15771: Missing Encryption of Sensitive Data
An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows remote attacker to bypass CSRF mitigation...
PT-2020-14618
Name of the Vulnerable Software and Affected Versions Gradle Enterprise version 2018.2 Gradle Enterprise Build Cache Node version 4.1 Description An issue allows a remote attacker to bypass CSRF mitigation due to cross-site transmission of a cookie containing a CSRF token. Recommendations For...