com.github.stefanliebenberg:blender-css (>=1.0, <=1.1), io.tesla.polyglot:tesla-polyglot-ruby (>=0.1.0, <=0.1.1) +5 more potentially affected by CVE-2018-1000076 via org.jruby:jruby-stdlib (1.7.12)

org.jruby:jruby-stdlib MAVEN version 1.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - com.github.stefanliebenberg:blender-css =1.0, =0.1.0, =2.12.4, =2.1.0, =4.0.0 Source cves: CVE-2018-1000076 Source...

org.jruby:jruby (1.7.11), org.jruby:jruby-noasm (1.7.11) +7 more potentially affected by CVE-2018-1000077 via org.jruby:jruby-stdlib (1.7.11)

org.jruby:jruby-stdlib MAVEN version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby 1.7.11 - org.jruby:jruby-noasm 1.7.11 - org.nuiton.js:nuiton-js-wro 1.0.3 -...

org.jruby:jruby-core (1.7.2), org.sonatype.nexus.plugins:nexus-ruby-plugin (1.0.0) +1 more potentially affected by CVE-2018-1000077 via org.jruby:jruby-stdlib (1.7.2)

org.jruby:jruby-stdlib MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby-core 1.7.2 - org.sonatype.nexus.plugins:nexus-ruby-plugin 1.0.0 -...

org.jruby:jruby-core (1.7.2), org.sonatype.nexus.plugins:nexus-ruby-plugin (1.0.0) +1 more potentially affected by CVE-2018-1000078 via org.jruby:jruby-stdlib (1.7.2)

org.jruby:jruby-stdlib MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby-core 1.7.2 - org.sonatype.nexus.plugins:nexus-ruby-plugin 1.0.0 -...

Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks

An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider Nexus Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known...

GHSA-FJH2-QHFH-RVFC Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks

An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider Nexus Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known...

org.jruby:jruby-core (1.7.2), org.sonatype.nexus.plugins:nexus-ruby-plugin (1.0.0) +1 more potentially affected by CVE-2018-1000075 via org.jruby:jruby-stdlib (1.7.2)

org.jruby:jruby-stdlib MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby-core 1.7.2 - org.sonatype.nexus.plugins:nexus-ruby-plugin 1.0.0 -...

com.github.stefanliebenberg:blender-css (>=1.0, <=1.1), io.tesla.polyglot:tesla-polyglot-ruby (>=0.1.0, <=0.1.1) +5 more potentially affected by CVE-2018-1000075 via org.jruby:jruby-stdlib (1.7.12)

org.jruby:jruby-stdlib MAVEN version 1.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - com.github.stefanliebenberg:blender-css =1.0, =0.1.0, =2.12.4, =2.1.0, =4.0.0 Source cves: CVE-2018-1000075 Source...

com.google.code.maven-play-plugin:play-maven-plugin (1.0.0-beta6), com.googlecode.maven-download-plugin:download-maven-plugin (>=1.2.0, <=1.2.1) +11 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (2.4.1)

org.codehaus.plexus:plexus-archiver MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.google.code.maven-play-plugin:play-maven-plugin 1.0.0-beta6 -...

org.jruby:jruby-core (1.7.2), org.sonatype.nexus.plugins:nexus-ruby-plugin (1.0.0) +1 more potentially affected by CVE-2018-1000073 via org.jruby:jruby-stdlib (1.7.2)

org.jruby:jruby-stdlib MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby-core 1.7.2 - org.sonatype.nexus.plugins:nexus-ruby-plugin 1.0.0 -...

org.jruby:jruby (1.7.11), org.jruby:jruby-noasm (1.7.11) +7 more potentially affected by CVE-2018-1000073 via org.jruby:jruby-stdlib (1.7.11)

org.jruby:jruby-stdlib MAVEN version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - org.jruby:jruby 1.7.11 - org.jruby:jruby-noasm 1.7.11 - org.nuiton.js:nuiton-js-wro 1.0.3 -...

com.github.stefanliebenberg:blender-css (>=1.0, <=1.1), io.tesla.polyglot:tesla-polyglot-ruby (>=0.1.0, <=0.1.1) +5 more potentially affected by CVE-2018-1000073 via org.jruby:jruby-stdlib (1.7.12)

org.jruby:jruby-stdlib MAVEN version 1.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jruby:jruby-stdlib and may be impacted: - com.github.stefanliebenberg:blender-css =1.0, =0.1.0, =2.12.4, =2.1.0, =4.0.0 Source cves: CVE-2018-1000073 Source...

Hackers Deploy IceApple Exploitation Framework on Hacked MS Exchange Servers

Researchers have detailed a previously undocumented .NET-based post-exploitation framework called IceApple that has been deployed on Microsoft Exchange server instances to facilitate reconnaissance and data exfiltration. "Suspected to be the work of a state-nexus adversary, IceApple remains under...

CVE-2022-27907

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

CVE-2022-27907

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

Server side request forgery (ssrf)

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

CVE-2022-27907

CVE-2022-27907 affects Sonatype Nexus Repository Manager 3.x before 3.38.0, with an SSRF vulnerability. Connected documents describe a code issue that forces the server to send a query request, enabling SSRF. Exploitation details are not provided in the sources; no in‑the‑wild exploit data is sta...

CVE-2022-27907

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

CVE-2022-27907

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

PT-2022-18682

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions prior to 3.38.0 Description The issue allows for Server-Side Request Forgery SSRF, which is a type of attack where an attacker can trick a server into making requests to arbitrary domains. This can...