161 matches found
CVE-2025-27137 Dependency-Track vulnerable to local file inclusion via custom notification templates
Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the SYSTEMCONFIGURATION permission to customize notification templates. Templates are evaluated using the Pebble template engine...
Dependency-Track 安全漏洞
Dependency-Track is Dependency-Track's open source set of intelligent supply chain component analysis platforms for identifying third-party component risks. A security vulnerability exists in Dependency-Track versions prior to 4.12.6, which stems from improper handling of include tags in the Pebb...
CVE-2025-27137: External Control of File Name or Path
Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the SYSTEMCONFIGURATION permission to customize notification templates. Templates are evaluated using the Pebble template engine...
CVE-2024-54002
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
CVE-2024-54002
Dependency-Track suffers a timing-based user enumeration flaw in /api/v1/user/login for usernames known to the system (LDAP/OpenID Connect users are unaffected). This CVE identifies that a longer response time reveals valid usernames, with the issue fixed in Dependency-Track 4.12.2. Affected prod...
PT-2024-36009 · Unknown · Dependency-Track
Name of the Vulnerable Software and Affected Versions: Dependency-Track versions prior to 4.12.2 Description: The issue allows actors to enumerate valid names of managed users by leveraging the observable difference in request duration when performing a login request against the...
Dependency-Track 安全漏洞
Dependency-Track is Dependency-Track's open source set of intelligent supply chain component analysis platforms for identifying third-party component risks. A security vulnerability exists in Dependency-Track versions prior to 4.12.2 that stems from a significantly longer response time when...
CVE-2024-54002: Observable Discrepancy
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
CVE-2024-38374 vulnerabilities
Vulnerabilities for packages: hadoop-fips, dependency-track...
CVE-2024-38374 vulnerabilities
Vulnerabilities for packages: dependency-track...
GHSA-683X-4444-JXH8 vulnerabilities
Vulnerabilities for packages: hadoop-fips, dependency-track...
GHSA-683X-4444-JXH8 vulnerabilities
Vulnerabilities for packages: dependency-track...
GHSA-24RP-Q3W6-VC56 vulnerabilities
Vulnerabilities for packages: mariadb, trino, dependency-track, keycloak...
GHSA-24RP-Q3W6-VC56 vulnerabilities
Vulnerabilities for packages: keycloak, mariadb, trino, dependency-track...
GHSA-XFG6-62PX-CXC2 vulnerabilities
Vulnerabilities for packages: keycloak-fips, dependency-track, mariadb, keycloak, trino...