Dependency-Track 安全漏洞

Dependency-Track is Dependency-Track's open source suite of intelligent supply chain component analysis platforms for identifying third-party component risks. A security vulnerability exists in Dependency-Track versions prior to 4.13.5, which stems from the possibility of sending private NuGet...

PT-2025-41166

Name of the Vulnerable Software and Affected Versions Dependency-Track versions prior to 4.13.5 Description Dependency-Track is a component analysis platform used for managing software supply chain risk. Versions prior to 4.13.5 may inadvertently transmit credentials intended for a private NuGet...

EUVD-2025-5076

Malicious code in bioql PyPI...

EUVD-2022-5312

Malicious code in bioql PyPI...

EUVD-2022-7072

Malicious code in bioql PyPI...

EUVD-2022-41821

Malicious code in bioql PyPI...

CVE-2025-7962 vulnerabilities

Vulnerabilities for packages: dependency-track, thingsboard, wildfly, keycloak, sonarqube, keycloak-config-cli, apache-nifi, apicurio-registry, jenkins...

GHSA-9342-92GG-6V29 vulnerabilities

Vulnerabilities for packages: dependency-track, thingsboard, wildfly, keycloak, sonarqube, keycloak-config-cli, apache-nifi, apicurio-registry, jenkins...

GHSA-9342-92GG-6V29 vulnerabilities

Vulnerabilities for packages: elasticsearch, apicurio-registry, elasticsearch-fips, dependency-track, jenkins, thingsboard, apache-nifi, geoserver, keycloak-config-cli, sonarqube, wildfly, commercial-elasticsearch, keycloak...

CVE-2025-7962 vulnerabilities

Vulnerabilities for packages: elasticsearch, apicurio-registry, elasticsearch-fips, dependency-track, jenkins, thingsboard, apache-nifi, geoserver, keycloak-config-cli, sonarqube, wildfly, commercial-elasticsearch, keycloak...

CVE-2024-54002

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...

CVE-2022-39350

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...

CVE-2021-21632

A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2021-21633

A cross-site request forgery CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2019-1020007

Dependency-Track before 3.5.1 allows XSS...

CVE-2025-27137

Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the SYSTEMCONFIGURATION permission to customize notification templates. Templates are evaluated using the Pebble template engine...

CVE-2025-27137

Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the SYSTEMCONFIGURATION permission to customize notification templates. Templates are evaluated using the Pebble template engine...

CVE-2025-27137 Dependency-Track vulnerable to local file inclusion via custom notification templates

Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the SYSTEMCONFIGURATION permission to customize notification templates. Templates are evaluated using the Pebble template engine...

CVE-2025-27137

Summary: CVE-2025-27137 affects Dependency-Track where templates are evaluated with Pebble and can be manipulated via the include tag. Prior to version 4.12.6, users with the SYSTEM_CONFIGURATION permission could exploit include to read arbitrary local files (e.g., /etc/passwd, /proc/1/environ) b...

CVE-2025-27137 Dependency-Track vulnerable to local file inclusion via custom notification templates

Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the SYSTEMCONFIGURATION permission to customize notification templates. Templates are evaluated using the Pebble template engine...