PT-2021-23634

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions 3.x through 3.35.0 Description The issue allows attackers to access the SSL Certificates Loading function via a low-privileged account. Recommendations For versions 3.x through 3.35.0, update to a...

CVE-2021-42568: Undefined Security Weakness

Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account...

Sonatype Nexus Repository Manager information leakage vulnerability

Sonatype Nexus Repository Manager NXRM is a repository manager from Sonatype, Inc. that is used to manage, store, and distribute software, among other things. An information disclosure vulnerability exists in Sonatype Nexus Repository Manager, which can be exploited by an attacker to bypass acces...

Cisco NX-OS MPLS OAM Maintenance Failure

The vulnerability of the MPLS Operation, Administration, and Maintenance OAM function in the Cisco NX-OS operating system is related to the lack of checks on buffer length and reading beyond the memory boundary. Exploiting this vulnerability can allow a malicious actor to cause service...

Vulnerability fixed in Sonatype Nexus

Sonatype has fixed a vulnerability in Nexus Repository. A unauthenticated malicious party could potentially gain access to sensitive information via an HTTP header injection to potentially gain access to sensitive information. Sonatype has released little further substantive information. Sonatype...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.33.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.33.1-01) +38 more potentially affected by CVE-2021-40143 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.33.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =0.0.1, =3.17.0-01, =0.0.2, =0.0.2, =3.19.0-01, =0.0.3, =1.0.0, =0.0.4, =0.0.2, =3.17.0-01, =3.32.1-01 and more Source cves: CVE-2021-40143 Source advisory: GHSA-F34X-8PF6-QC9Chttps:...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.33.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.33.1-01) +38 more potentially affected by CVE-2021-40143 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.33.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =0.0.1, =3.17.0-01, =0.0.2, =0.0.2, =3.19.0-01, =0.0.3, =1.0.0, =0.0.4, =0.0.2, =3.17.0-01, =3.32.1-01 and more Source cves: CVE-2021-40143 Source advisory: OSV:GHSA-F34X-8PF6-QC9Cht...

GHSA-F34X-8PF6-QC9C HTTP header injection in Sonatype Nexus Repository

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

Design/Logic Flaw

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.33.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.33.1-01) +38 more potentially affected by CVE-2021-40143 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.33.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =0.0.1, =3.17.0-01, =0.0.2, =0.0.2, =3.19.0-01, =0.0.3, =1.0.0, =0.0.4, =0.0.2, =3.17.0-01, =3.32.1-01 and more Source cves: CVE-2021-40143 Source advisory: MEND:CVE-2021-40143https:...

CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

CVE-2021-40143

Summary: CVE-2021-40143 affects Sonatype Nexus Repository 3.x up to 3.33.1-01 and is caused by an HTTP header injection vulnerability. An attacker can craft requests that may disclose sensitive information or cause the server to fetch external resources. Exploitation details are not provided in t...

PT-2021-22818

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions 3.x through 3.33.1-01 Description The issue allows a remote attacker to disclose sensitive information or request external resources from a vulnerable instance by sending a crafted HTTP request. This is due t...

CVE-2021-40143: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

Cisco Issues Patch for Critical Enterprise NFVIS Flaw — PoC Exploit Available

Cisco has patched a critical security vulnerability impacting its Enterprise Network Function Virtualization Infrastructure Software NFVIS that could be exploited by an attacker to take control of an affected system. Tracked as CVE-2021-34746, the weakness has been rated 9.8 out of a maximum of 1...

CVE-2021-34765

A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and download files related to the web application. The attacker requires valid device credentials. This vulnerability exists because proper role-based access control RBAC filters are not...