PT-2020-14614

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2020.2.5 Description An issue allows an attacker with the ability to perform a man-in-the-middle MITM attack on plain HTTP requests to obtain the CSRF prevention token cookie, if the user mistakenly uses an...

PT-2020-14622 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2017.1 through 2020.2.4 Description: An issue was discovered where the /usage page of Gradle Enterprise conveys high-level build information, such as project names and build counts over time, and this page is...

PT-2020-14620

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2020.2.4 Description An issue allows an attacker to access data as a user after previously explicitly authenticating with the API, due to unrestricted cross-origin requests to read-only data in the Export AP...

PT-2020-14619 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2018.5 through 2020.2.4 Description: An issue allows a remote attacker with administrative access to perform server side request forgery when configuring Gradle Enterprise to integrate with a SAML identity provider...

PT-2020-14618

Name of the Vulnerable Software and Affected Versions Gradle Enterprise version 2018.2 Gradle Enterprise Build Cache Node version 4.1 Description An issue allows a remote attacker to bypass CSRF mitigation due to cross-site transmission of a cookie containing a CSRF token. Recommendations For...

CVE-2020-15767: Missing Encryption of Sensitive Data

An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS...

[ASA-202009-7] netbeans: arbitrary code execution

Arch Linux Security Advisory ASA-202009-7 ========================================= Severity: Critical Date : 2020-09-14 CVE-ID : CVE-2020-11986 Package : netbeans Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1221 Summary ======= The package netbeans befo...

CVE-2020-11986

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis o...

CVE-2020-11986

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis o...

CVE-2020-11986

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis o...

CVE-2020-15777

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization...

Deserialization of untrusted data

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization...

CVE-2020-15777

The CVE-2020-15777 issue affects the Maven Extension plugin for Gradle Enterprise prior to version 1.6. The plugin uses a socket connection to send serialized Java objects and deserialization is not restricted to an allow-list, enabling code execution via a malicious deserialization gadget chain....

CVE-2020-15777

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization...

CVE-2020-15777: Deserialization of Untrusted Data

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization...

PT-2020-14624 · Gradle · Maven Extension Plugin

Name of the Vulnerable Software and Affected Versions: Maven Extension plugin versions prior to 1.6 for Gradle Enterprise Description: An issue was discovered in the Maven Extension plugin, where the extension uses a socket connection to send serialized Java objects. Deserialization is not...

gradle.plugin.io.jooby:jooby-gradle-plugin (>=2.7.0, <=2.8.1), io.jooby.openapi:io.jooby.openapi.gradle.plugin (>=2.7.0, <=2.8.1) +33 more potentially affected by CVE-2020-7647 via io.jooby:jooby (>=2.0.0.m1, <=2.8.1)

io.jooby:jooby MAVEN version =2.0.0.m1, =2.7.0, =2.7.0, =2.7.0, =2.1.0, =2.6.0, =2.0.6, =2.6.1, =2.0.0, =2.0.0.m1, =2.4.0, =2.4.0, =2.4.0, =2.7.2, =2.0.0.m2, =2.0.0.m1, =2.8.1 and more Source cves: CVE-2020-7647 Source advisory: MEND:CVE-2020-7647...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...