CVE-2021-23163

JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF Cross-Site Request Forgery for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6...

CVE-2021-23163

CVE-2021-23163 affects JFrog Artifactory. Multiple connected sources confirm a CSRF vulnerability on specific endpoints in Artifactory versions before 7.33.6 and before 6.23.38. The root cause is described as a CSRF issue; exploit details are not provided in the documents. Remediation: upgrade to...

CVE-2021-46687

JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versio...

CVE-2021-46687

CVE-2021-46687 affects JFrog Artifactory: versions prior to 7.31.10 and prior to 6.23.38 are vulnerable to sensitive data exposure through the Project Administrator REST API . The underlying issue is exposed in the REST API and leads to leakage of sensitive data in affected releases. The provided...

CVE-2021-45721

CVE-2021-45721 affects JFrog Artifactory. Vulnerable through Reflected XSS in a Users REST API XHR parameter due to insufficient input validation. Affected versions: before 7.29.8 and before 6.23.38. Impact: potential client-side JavaScript execution. Remediation (as documented): upgrade to 7.29....

CVE-2021-45721

JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting XSS through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to 7.29.8; JFrog Artifactory...

PT-2022-12372 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.29.8 JFrog Artifactory versions prior to 6.23.38 Description: The issue is related to Reflected Cross-Site Scripting XSS through one of the XHR parameters in the "Users REST API endpoint". Recommendations...

PT-2022-9369 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.33.6 JFrog Artifactory versions prior to 6.23.38 Description: The issue affects JFrog Artifactory, making it vulnerable to Cross-Site Request Forgery CSRF for specific endpoints. Recommendations: For...

JFrog Artifactory 跨站请求伪造漏洞

JFrog Artifactory is an open source, general-purpose Artifact repository manager from Israel's JFrog that supports clustering and high-availability Docker registries, and provides an end-to-end solution for automating the tracking of artifacts from development to production. A security...

JFrog Artifactory 安全漏洞

JFrog Artifactory is an open source, general-purpose Artifact repository manager from Israel's JFrog that supports clustering and high-availability Docker registries, and provides an end-to-end solution for automating the tracking of artifacts from development to production. A security...

PT-2022-12902 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.31.10 JFrog Artifactory versions prior to 6.23.38 Description: The issue affects JFrog Artifactory, where sensitive data exposure can occur through the Project Administrator REST API. Recommendations: For...

JFrog Artifactory 跨站脚本漏洞

JFrog Artifactory is an open source general-purpose Artifact repository manager from Israel-based JFrog that supports clustering and high-availability Docker registries and provides an end-to-end solution for tracking artifact automation from development to production.JFrog Artifactory suffers fr...

Malicious code in pipeline-npm-artifactory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bab6877d6c87d826709ecb4658b55ae25609fa03bb1ae1225f771b4d841f196a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview pipeline-npm-artifactory is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

MAL-2022-1124 Malicious code in artifactory-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9674a280d091d3ecb0071c6fc0687be3f01662dd45df2effce8d90143966703 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in artifactory-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9674a280d091d3ecb0071c6fc0687be3f01662dd45df2effce8d90143966703 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site request forgery vulnerability in Jenkins Artifactory Plugin

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseActiondoSubmit, GradleReleaseApiActiondoStaging, MavenReleaseApiActiondoStaging, and UnifiedPromoteBuildActiondoSubmit allowed attackers to schedule a release build, perform release staging for...

GHSA-MQJ3-FC39-73FJ Cross-site request forgery vulnerability in Jenkins Artifactory Plugin

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseActiondoSubmit, GradleReleaseApiActiondoStaging, MavenReleaseApiActiondoStaging, and UnifiedPromoteBuildActiondoSubmit allowed attackers to schedule a release build, perform release staging for...

GHSA-8Q6R-5HC6-HRR8 Jenkins Artifactory Plugin cross-site request forgery vulnerability

Jenkins Artifactory Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...

Jenkins Artifactory Plugin missing permission check

Jenkins Artifactory Plugin provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be used...