Lucene search
+L

6 matches found

NVD
NVD
•added 2026/08/07 5:16 p.m.•21 views

CVE-2026-17595

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

5.3CVSS0.00232EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/08/07 4:07 p.m.•12 views

CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

5.3CVSS5.5AI score0.00232EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/08/07 4:07 p.m.•19 views

EUVD-2026-54519

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

5.3CVSS5.5AI score0.00232EPSS
SaveExploits0References2
CVE
CVE
•added 2026/08/07 4:07 p.m.•64 views

CVE-2026-17595

Nexus Repository 3 is affected by a JEXL Content Selector sandbox bypass where an account with nexus:selectors:create could read Java object properties not intended for exposure, potentially revealing internal JVM class metadata (e.g., class and classloader names). The issue stems from incomplete...

5.3CVSS5.5AI score0.00232EPSS
SaveExploits0References2Affected Software1
attackerkb
attackerkb
•added 2026/08/07 4:07 p.m.•22 views

CVE-2026-17595

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

5.3CVSS5.5AI score0.00232EPSS
SaveExploits0References3Affected Software1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/07 12:00 a.m.•1 views

CVE-2026-17595: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

5.3CVSS6.3AI score0.00232EPSS
SaveExploits0References3
Rows per page
Query Builder