Malicious Package

Overview nexus-snyk-security-plugin is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

Sonatype Nexus Repository Manager Privilege Escalation

The vulnerability of Sonatype Nexus Repository Manager is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

PT-2022-20666

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager OSS version 3.37.3-02 Description The issue is related to incorrect access control, allowing for authentication bypass. This can be exploited remotely, with the attack vector involving response manipulation. A...

Follina Exploited by State-Sponsored Hackers

Researchers have added state-sponsored hackers to the list of adversaries attempting to exploit Microsoft’s now-patched Follina vulnerability. According to researchers at Proofpoint, state-sponsored hackers have attempted to abuse the Follina vulnerability in Microsoft Office, aiming an email-bas...

@nexus-switchboard/nexus-conn-jira (>=0.1.0, <=0.2.2), @nexus-switchboard/nexus-mod-service (>=0.4.1, <=0.6.3) +1 more potentially affected by CVE-2021-26073 via atlassian-connect-express (>=3.5.2, <=4.4.1)

atlassian-connect-express NPM version =3.5.2, =0.1.0, =0.4.1, =0.0.1, =2.0.5 Source cves: CVE-2021-26073 Source advisory: OSV:GHSA-4V96-M8XV-X83V...

Jenkins Maven Release Plug-in Plugin XXE vulnerability

Jenkins Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. While Jenkins users without Overall/Administer permission are not allowed to configu...

GHSA-7MF5-79GV-66GH Jenkins Maven Release Plug-in Plugin XXE vulnerability

Jenkins Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. While Jenkins users without Overall/Administer permission are not allowed to configu...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.18.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.18.1-01) +22 more potentially affected by CVE-2019-16530 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.18.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =3.17.0-01, =0.0.4, =3.17.0-01, =3.1.0-04, =3.1.0-04, =3.11.0-01, =0.0.2, =3.13.0-01, =1.0.4, =1.0.6 and more Source cves: CVE-2019-16530 Source advisory: GHSA-HMJV-PX3J-933Chttps://v...

Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution...

GHSA-HMJV-PX3J-933C Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.18.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.18.1-01) +22 more potentially affected by CVE-2019-16530 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.18.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =3.17.0-01, =0.0.4, =3.17.0-01, =3.1.0-04, =3.1.0-04, =3.11.0-01, =0.0.2, =3.13.0-01, =1.0.4, =1.0.6 and more Source cves: CVE-2019-16530 Source advisory: OSV:GHSA-HMJV-PX3J-933Chttps...

sp.sd:nexus-artifact-uploader (>=2.1, <=2.2) potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.26)

org.jenkins-ci.plugins:credentials MAVEN version 1.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - sp.sd:nexus-artifact-uploader =2.1, =2.2 Source cves: CVE-2019-10320 Source advisory:...

sp.sd:nexus-artifact-uploader (>=2.1, <=2.2) potentially affected by CVE-2018-1000601 via org.jenkins-ci.plugins:credentials (1.26)

org.jenkins-ci.plugins:credentials MAVEN version 1.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - sp.sd:nexus-artifact-uploader =2.1, =2.2 Source cves: CVE-2018-1000601 Source advisory:...

org.jruby:jruby-core (1.7.2), org.sonatype.nexus.plugins:nexus-ruby-plugin (1.0.0) +1 more potentially affected by CVE-2018-1000079 via org.jruby:jruby-stdlib (1.7.2)

org.jruby:jruby-stdlib MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby-core 1.7.2 - org.sonatype.nexus.plugins:nexus-ruby-plugin 1.0.0 -...

com.github.stefanliebenberg:blender-css (>=1.0, <=1.1), io.tesla.polyglot:tesla-polyglot-ruby (>=0.1.0, <=0.1.1) +5 more potentially affected by CVE-2018-1000079 via org.jruby:jruby-stdlib (1.7.12)

org.jruby:jruby-stdlib MAVEN version 1.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - com.github.stefanliebenberg:blender-css =1.0, =0.1.0, =2.12.4, =2.1.0, =4.0.0 Source cves: CVE-2018-1000079 Source...

jenkins.plugins.htmlaudio:html-audio-notifier (0.1), org.jenkins-ci.main:jenkins-test-harness (1.431) +14 more potentially affected by CVE-2017-1000391 via org.jenkins-ci.main:jenkins-core (1.431)

org.jenkins-ci.main:jenkins-core MAVEN version 1.431 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - jenkins.plugins.htmlaudio:html-audio-notifier 0.1 - org.jenkins-ci.main:jenkins-test-harness...

org.jruby:jruby-core (1.7.2), org.sonatype.nexus.plugins:nexus-ruby-plugin (1.0.0) +1 more potentially affected by CVE-2018-1000074 via org.jruby:jruby-stdlib (1.7.2)

org.jruby:jruby-stdlib MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby-core 1.7.2 - org.sonatype.nexus.plugins:nexus-ruby-plugin 1.0.0 -...

com.github.stefanliebenberg:blender-css (>=1.0, <=1.1), io.tesla.polyglot:tesla-polyglot-ruby (>=0.1.0, <=0.1.1) +5 more potentially affected by CVE-2018-1000074 via org.jruby:jruby-stdlib (1.7.12)

org.jruby:jruby-stdlib MAVEN version 1.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - com.github.stefanliebenberg:blender-css =1.0, =0.1.0, =2.12.4, =2.1.0, =4.0.0 Source cves: CVE-2018-1000074 Source...

org.jruby:jruby-core (1.7.2), org.sonatype.nexus.plugins:nexus-ruby-plugin (1.0.0) +1 more potentially affected by CVE-2018-1000076 via org.jruby:jruby-stdlib (1.7.2)

org.jruby:jruby-stdlib MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby-core 1.7.2 - org.sonatype.nexus.plugins:nexus-ruby-plugin 1.0.0 -...

org.jruby:jruby (1.7.11), org.jruby:jruby-noasm (1.7.11) +7 more potentially affected by CVE-2018-1000076 via org.jruby:jruby-stdlib (1.7.11)

org.jruby:jruby-stdlib MAVEN version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby 1.7.11 - org.jruby:jruby-noasm 1.7.11 - org.nuiton.js:nuiton-js-wro 1.0.3 -...