CVE-2018-5306

Multiple cross-site scripting XSS vulnerabilities in Sonatype Nexus Repository Manager aka NXRM 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via 1 the repoId or 2 format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; 3 the filename in...

PT-2018-16883

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions 3.x before 3.8 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several...

CVE-2018-5306: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Sonatype Nexus Repository Manager aka NXRM 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via 1 the repoId or 2 format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; 3 the filename in...

CVE-2018-5307: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Sonatype Nexus Repository Manager aka NXRM 2.x before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via 1 the repoId or 2 format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; 3 the filename...

PT-2018-16884

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions prior to 2.14.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several...

Sonatype Nexus Repository Manager OSS/Pro 2.14.5 / 3.7.1 XSS

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Cross-Site Scripting Vulnerabilities product: Sonatype Nexus Repository Manager OSS/Pro vulnerable version: =2.14.5, =3.7.1 fixed version: 2.14.6, 3.8.0 CVE...

The vulnerability of Sonatype Nexus Repository Manager, related to the use of cryptographic algorithms containing defects, allows a perpetrator to gain access to authentication data.

The vulnerability of Sonatype Nexus Repository Manager is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to user authentication data and other sensitive information...

Sonatype Nexus Repository Manager Weak Password Vulnerability

Sonatype Nexus Repository Manager is a maven repository manager. A security vulnerability exists in the LDAP integration feature in Sonatype Nexus Repository Manager 2.14.5 and earlier versions, which stems from the program's use of hard-coded CMMDwoV values to encrypt passwords. An attacker coul...

Sonatype Nexus Repository Manager 2.x Weak Password Encryption Vulnerability (Dec 2017)

Sonatype Nexus Repository Manager has a weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2017-17717

Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature...

CVE-2017-17717

Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature...

CVE-2017-17717

CVE-2017-17717 affects Sonatype Nexus Repository Manager up to version 2.14.5. The vulnerability lies in the LDAP integration feature, which uses hard-coded CMMDwoV values to encrypt passwords, resulting in weak password encryption. Documents consistently describe the issue as a weakness in passw...

CVE-2017-17717: Use of a Broken or Risky Cryptographic Algorithm

Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature...

PT-2017-3360

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions through 2.14.5 Description The issue is related to weak password encryption in the LDAP integration feature, with a hardcoded value. This weakness may allow a remote attacker to access user...

HP Version Control Repository Manager < 7.6.0 Multiple Vulnerabilities

According to its self-reported version, the HP Version Control Repository Manager VCRM application installed on the remote Windows host is prior to 7.6.0. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in OpenSSL in x509vfy.c due to improper...

HPE Version Control Repository Manager Cross-Site Request Forgery Vulnerability

HPE Version Control Repository Manager VCRM is a repository for storing software and firmware that supports ProLiant servers from HewlettPackardEnterprise HPE, USA. A cross-site request forgery vulnerability exists in HPE Version Control Repository Manager VCRM versions prior to 7.6. A remote...

HPE Version Control Repository Manager File Upload Vulnerability

HPE Version Control Repository Manager VCRM is a repository for storing software and firmware that supports ProLiant servers from HewlettPackardEnterprise HPE, USA. A security vulnerability exists in HPE Version Control Repository Manager VCRM versions prior to 7.6. A remote attacker could exploi...

HPE Version Control Repository Manager Information Disclosure Vulnerability

HPE Version Control Repository Manager VCRM is a repository for storing software and firmware that supports ProLiant servers from HewlettPackardEnterprise HPE, USA. An information disclosure vulnerability exists in HPE Version Control Repository Manager versions prior to 7.6. A remote attacker...

Sonatype Nexus Repository Manager Detection

Binary data sonatypenexusdetect.nbin...

Sonatype Nexus Repository Manager Java Object Deserialization RCE

The Sonatype Nexus Repository Manager server application running on the remote host is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections ACC library. An unauthenticated, remote attacker can exploit...