251 matches found
CVE-2020-15775
An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts over time. This page is incorrectly viewable anonymously...
CVE-2020-15775
Mode C: The CVE-2020-15775 entry affects Gradle Enterprise 2017.1–2020.2.4. The /usage page exposes high-level build information (e.g., project names and build counts over time) and is viewable anonymously, creating an information-disclosure risk. No exploit details are provided in the sources be...
CVE-2020-15776
An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An attacker with the ability to execute arbitrary code in a user's browser could impose an arbitrary value for this token, allowing them to...
CVE-2020-15776
Gradle Enterprise versions 2018.2 through 2020.2.4 are affected by a CSRF vulnerability. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly, allowing a user’s browser to be manipulated by an attacker with potential JavaScript access to set an arbitrary token...
CVE-2020-15768
An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2. Unrestricted HTTP header reflection in Gradle Enterprise allows remote attackers to obtain authentication cookies, if they are able to discover a separate XSS vulnerability. This...
CVE-2020-15768
Gradle Enterprise (versions 2017.3–2020.2.4) and Gradle Enterprise Build Cache Node (versions 1.0–9.2) are affected by an unrestricted HTTP header reflection vulnerability that can allow remote attackers to obtain authentication cookies and impersonate a user if a separate XSS issue exists. Affec...
CVE-2020-15769
An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4. An XSS issue exists via the request URL...
CVE-2020-15769
The CVE-2020-15769 issue affects Gradle Enterprise 2020.2 to 2020.2.4, with a cross-site scripting (XSS) vulnerability exposed via the request URL in the Web application. Descriptions in multiple sources attribute the root cause to insufficient validation of client-side data, allowing execution o...
PT-2020-14623 · Gradle · Gradle Enterprise
Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2018.2 through 2020.2.4 Description: An issue was discovered where the CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. This allows an attacker with the ability to execute...
PT-2020-14615 · Gradle · Gradle Enterprise +1
Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2017.3 through 2020.2.4 Gradle Enterprise Build Cache Node versions 1.0 through 9.2 Description: An issue in Gradle Enterprise allows remote attackers to obtain authentication cookies through unrestricted HTTP heade...
PT-2020-14617 · Gradle · Gradle Enterprise
Name of the Vulnerable Software and Affected Versions: Gradle Enterprise version 2018.5 Description: An issue was discovered that allows an attacker to make repeated attempts to guess a local user's password due to the lack of lock-out after excessive failed logins. Recommendations: For Gradle...
PT-2020-14622 · Gradle · Gradle Enterprise
Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2017.1 through 2020.2.4 Description: An issue was discovered where the /usage page of Gradle Enterprise conveys high-level build information, such as project names and build counts over time, and this page is...
PT-2020-14619 · Gradle · Gradle Enterprise
Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2018.5 through 2020.2.4 Description: An issue allows a remote attacker with administrative access to perform server side request forgery when configuring Gradle Enterprise to integrate with a SAML identity provider...
PT-2020-14621 · Gradle · Gradle Enterprise
Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2018.5 through 2020.2.4 Description: An issue was discovered where an attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reope...
CVE-2020-15777
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization...
Deserialization of untrusted data
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization...
CVE-2020-15777
The CVE-2020-15777 issue affects the Maven Extension plugin for Gradle Enterprise prior to version 1.6. The plugin uses a socket connection to send serialized Java objects and deserialization is not restricted to an allow-list, enabling code execution via a malicious deserialization gadget chain....
CVE-2020-15777
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization...
PT-2020-14624 · Gradle · Maven Extension Plugin
Name of the Vulnerable Software and Affected Versions: Maven Extension plugin versions prior to 1.6 for Gradle Enterprise Description: An issue was discovered in the Maven Extension plugin, where the extension uses a socket connection to send serialized Java objects. Deserialization is not...
