CVE-2021-42568

Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account...

CVE-2021-42568

Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account...

CVE-2021-42568

Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account...

CVE-2021-42568

CVE-2021-42568 affects Sonatype Nexus Repository Manager 3.x up to 3.35.0. The vulnerability arises from incorrect access control that allows a low-privileged account to access the SSL Certificates Loading function, potentially exposing sensitive certificate-related data. The documented impact is...

CVE-2021-42568: Undefined Security Weakness

Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account...

PT-2021-23634

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions 3.x through 3.35.0 Description The issue allows attackers to access the SSL Certificates Loading function via a low-privileged account. Recommendations For versions 3.x through 3.35.0, update to a...

Sonatype Nexus Repository Manager information leakage vulnerability

Sonatype Nexus Repository Manager NXRM is a repository manager from Sonatype, Inc. that is used to manage, store, and distribute software, among other things. An information disclosure vulnerability exists in Sonatype Nexus Repository Manager, which can be exploited by an attacker to bypass acces...

Vulnerability fixed in Sonatype Nexus

Sonatype has fixed a vulnerability in Nexus Repository. A unauthenticated malicious party could potentially gain access to sensitive information via an HTTP header injection to potentially gain access to sensitive information. Sonatype has released little further substantive information. Sonatype...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.33.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.33.1-01) +38 more potentially affected by CVE-2021-40143 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.33.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =0.0.1, =3.17.0-01, =0.0.2, =0.0.2, =3.19.0-01, =0.0.3, =1.0.0, =0.0.4, =0.0.2, =3.17.0-01, =3.32.1-01 and more Source cves: CVE-2021-40143 Source advisory: GHSA-F34X-8PF6-QC9Chttps:...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.33.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.33.1-01) +38 more potentially affected by CVE-2021-40143 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.33.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =0.0.1, =3.17.0-01, =0.0.2, =0.0.2, =3.19.0-01, =0.0.3, =1.0.0, =0.0.4, =0.0.2, =3.17.0-01, =3.32.1-01 and more Source cves: CVE-2021-40143 Source advisory: OSV:GHSA-F34X-8PF6-QC9Cht...

GHSA-F34X-8PF6-QC9C HTTP header injection in Sonatype Nexus Repository

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

Design/Logic Flaw

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.33.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.33.1-01) +38 more potentially affected by CVE-2021-40143 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.33.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =0.0.1, =3.17.0-01, =0.0.2, =0.0.2, =3.19.0-01, =0.0.3, =1.0.0, =0.0.4, =0.0.2, =3.17.0-01, =3.32.1-01 and more Source cves: CVE-2021-40143 Source advisory: MEND:CVE-2021-40143https:...

CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...

CVE-2021-40143

Summary: CVE-2021-40143 affects Sonatype Nexus Repository 3.x up to 3.33.1-01 and is caused by an HTTP header injection vulnerability. An attacker can craft requests that may disclose sensitive information or cause the server to fetch external resources. Exploitation details are not provided in t...

PT-2021-22818

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions 3.x through 3.33.1-01 Description The issue allows a remote attacker to disclose sensitive information or request external resources from a vulnerable instance by sending a crafted HTTP request. This is due t...

CVE-2021-40143: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance...