5342 matches found
Follina Exploited by State-Sponsored Hackers
Researchers have added state-sponsored hackers to the list of adversaries attempting to exploit Microsoft’s now-patched Follina vulnerability. According to researchers at Proofpoint, state-sponsored hackers have attempted to abuse the Follina vulnerability in Microsoft Office, aiming an email-bas...
@nexus-switchboard/nexus-conn-jira (>=0.1.0 <=0.2.2), @nexus-switchboard/nexus-mod-service (>=0.4.1 <=0.6.3) +1 more potentially affected by CVE-2021-26073 via atlassian-connect-express (>=3.5.2 <=4.4.1)
atlassian-connect-express NPM version =3.5.2, =0.1.0, =0.4.1, =0.0.1, =2.0.5 Source cves: CVE-2021-26073 Source advisory: OSV:GHSA-4V96-M8XV-X83V...
GHSA-7MF5-79GV-66GH Jenkins Maven Release Plug-in Plugin XXE vulnerability
Jenkins Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. While Jenkins users without Overall/Administer permission are not allowed to configu...
Jenkins Maven Release Plug-in Plugin XXE vulnerability
Jenkins Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. While Jenkins users without Overall/Administer permission are not allowed to configu...
org.sonatype.nexus.assemblies:nexus-base-template (>=3.10.0-04 <=3.18.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03 <=3.18.1-01) +21 more potentially affected by CVE-2019-16530 via org.sonatype.nexus:nexus-repository (>=3.0.0-03 <=3.18.1-01)
org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.10.0-04, =3.0.0-03, =3.10.0-04, =3.10.0-04, =3.17.0-01, =0.0.4, =3.17.0-01, =3.10.0-04, =3.10.0-04, =3.11.0-01, =0.0.2, =3.13.0-01, =1.0.4, =3.10.0-04, =3.18.1-01 and more Source cves: CVE-2019-16530 Source advisory: OSV:GHSA-HM...
Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution...
GHSA-HMJV-PX3J-933C Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution...
GHSA-FJH2-QHFH-RVFC Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks
An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider Nexus Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known...
Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks
An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider Nexus Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known...
Hackers Deploy IceApple Exploitation Framework on Hacked MS Exchange Servers
Researchers have detailed a previously undocumented .NET-based post-exploitation framework called IceApple that has been deployed on Microsoft Exchange server instances to facilitate reconnaissance and data exfiltration. "Suspected to be the work of a state-nexus adversary, IceApple remains under...
CVE-2022-27907
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...
CVE-2022-27907
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...
Server side request forgery (ssrf)
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...
CVE-2022-27907
CVE-2022-27907 affects Sonatype Nexus Repository Manager 3.x before 3.38.0, with an SSRF vulnerability. Connected documents describe a code issue that forces the server to send a query request, enabling SSRF. Exploitation details are not provided in the sources; no in‑the‑wild exploit data is sta...
CVE-2022-27907
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...
CVE-2022-27907
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...
Sonatype Nexus Repository Manager 代码问题漏洞
Sonatype Nexus Repository Manager NXRM is a repository manager from Sonatype, Inc. that is used for managing, storing, and distributing software, among other things. A code issue vulnerability exists in Sonatype Nexus Repository Manager3 versions prior to 3.38.0 that stems from forcing the server...
CVE-2021-43961
Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection...