1535 matches found
CVE-2022-25364
CVE-2022-25364 concerns Gradle Enterprise prior to 2021.4.2, where the default built-in build cache configuration allowed anonymous write access. If not manually changed, a network-accessible build cache could be populated with manipulated entries that execute malicious code during a build. As of...
CVE-2022-25364
In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute malicious code as par...
PT-2022-17242 · Gradle · Gradle Enterprise
Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions prior to 2021.4.2 Description: The default built-in build cache configuration in Gradle Enterprise allowed anonymous write access, potentially enabling a malicious actor with network access to populate the cache wit...
Gradle security vulnerabilities
Gradle is the U.S. Gradle company's set of JVM-based project build tool , it supports maven, Ivy repository and so on. Gradle Enterprise prior to 2021.4.2 suffers from a security vulnerability that stems from the default built-in build cache configuration allowing anonymous write access. If this...
CVE-2022-25364: Incorrect Default Permissions
In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute malicious code as par...
CVE-2022-27225
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
CVE-2022-27225
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
CVE-2022-27225
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
CVE-2022-27225
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
CVE-2022-27225
Gradle Enterprise before 2021.4.3 is affected by a session‑level vulnerability related to Keycloak cookies. During sign‑in, Keycloak sets cookies that effectively enable remember‑me functionality; for older Safari versions, a duplicate cookie is created without the Secure attribute. This allows t...
CVE-2022-27225: Missing Encryption of Sensitive Data
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
PT-2022-18312
Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2021.4.3 Description The issue arises from the use of cleartext data transmission in certain situations by Gradle Enterprise, which utilizes Keycloak for identity management services. During the sign-in...
Gradle information leakage vulnerability
Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. Gradle Enterprise suffers from a security vulnerability that stems from the fact that during the login process, Keycloak sets a browser cookie that effectively provides remember-...
Improper Locking in JetBrains Kotlin
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects...
GHSA-2QP4-G3Q3-F92W Improper Locking in JetBrains Kotlin
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects...
org.jetbrains.kotlin:kdoc (0.7.802), org.jetbrains.kotlin:kdoc-maven-plugin (0.7.802) +4 more potentially affected by CVE-2022-24329 via org.jetbrains.kotlin:kotlin-stdlib (0.7.802)
org.jetbrains.kotlin:kotlin-stdlib MAVEN version 0.7.802 is affected by a known vulnerability. The following packages have a transitive dependency on org.jetbrains.kotlin:kotlin-stdlib and may be impacted: - org.jetbrains.kotlin:kdoc 0.7.802 - org.jetbrains.kotlin:kdoc-maven-plugin 0.7.802 -...
org.jetbrains.kotlin:kdoc (0.7.852), org.jetbrains.kotlin:kdoc-maven-plugin (0.7.852) +4 more potentially affected by CVE-2022-24329 via org.jetbrains.kotlin:kotlin-stdlib (0.7.852)
org.jetbrains.kotlin:kotlin-stdlib MAVEN version 0.7.852 is affected by a known vulnerability. The following packages have a transitive dependency on org.jetbrains.kotlin:kotlin-stdlib and may be impacted: - org.jetbrains.kotlin:kdoc 0.7.852 - org.jetbrains.kotlin:kdoc-maven-plugin 0.7.852 -...
org.jetbrains.kotlin:kdoc (0.8.484), org.jetbrains.kotlin:kdoc-maven-plugin (0.8.484) +4 more potentially affected by CVE-2022-24329 via org.jetbrains.kotlin:kotlin-stdlib (0.8.484)
org.jetbrains.kotlin:kotlin-stdlib MAVEN version 0.8.484 is affected by a known vulnerability. The following packages have a transitive dependency on org.jetbrains.kotlin:kotlin-stdlib and may be impacted: - org.jetbrains.kotlin:kdoc 0.8.484 - org.jetbrains.kotlin:kdoc-maven-plugin 0.8.484 -...
org.jetbrains.kotlin:kdoc (0.8.679), org.jetbrains.kotlin:kdoc-maven-plugin (0.8.679) +4 more potentially affected by CVE-2022-24329 via org.jetbrains.kotlin:kotlin-stdlib (0.8.679)
org.jetbrains.kotlin:kotlin-stdlib MAVEN version 0.8.679 is affected by a known vulnerability. The following packages have a transitive dependency on org.jetbrains.kotlin:kotlin-stdlib and may be impacted: - org.jetbrains.kotlin:kdoc 0.8.679 - org.jetbrains.kotlin:kdoc-maven-plugin 0.8.679 -...