BIT-GRADLE-2022-30586

Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution...

BIT-GRADLE-2022-31156 Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed

Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through 7.4.2, there are some cases in which Gradle may skip that...

BIT-GRADLE-2023-26053 Gradle usage of long IDs for PGP keys opens potential for collision attacks

Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs 64bits for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a trusted-key or pgp element in their...

BIT-GRADLE-2023-35946 Dependency cache path traversal in Gradle

Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache, it uses the dependency's coordinates to compute a file location. With specially crafted dependency coordinates, Gradle can be made to writ...

BIT-GRADLE-2023-35947 Path traversal vulnerabilities in handling of Tar archives in Gradle

Gradle is a build tool with a focus on build automation and support for multi-language development. In affected versions when unpacking Tar archives, Gradle did not check that files could be written outside of the unpack location. This could lead to important files being overwritten anywhere the...

BIT-GRADLE-2023-42445 Possible local file exfiltration by XML External entity injection

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack OOB-XXE, just parsing XML can lead to exfiltration of local tex...

BIT-GRADLE-2023-44387 Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to...

GHSA-4265-CCF5-PHJ5 vulnerabilities

Vulnerabilities for packages: dependency-track, gradle, opensearch, celeborn, trino, druid, kayenta-fips, kayenta, tez, hadoop-fips, wavefront-proxy, spdx-tools-java, hadoop-client-modules...

GHSA-4265-CCF5-PHJ5 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, celeborn, trino, gradle, druid, dependency-track, tez, opensearch, wavefront-proxy...

GHSA-4G9R-VXHX-9PGX vulnerabilities

Vulnerabilities for packages: spdx-tools-java, celeborn, trino, gradle, druid, dependency-track, tez, opensearch, wavefront-proxy...

CVE-2024-26308 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, celeborn, trino, gradle, druid, dependency-track, tez, opensearch, wavefront-proxy...

CVE-2024-26308 vulnerabilities

Vulnerabilities for packages: dependency-track, gradle, opensearch, celeborn, trino, druid, kayenta-fips, kayenta, tez, hadoop-fips, wavefront-proxy, spdx-tools-java, hadoop-client-modules...

CVE-2024-25710 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, celeborn, trino, gradle, druid, dependency-track, tez, opensearch, wavefront-proxy...

CVE-2024-25710 vulnerabilities

Vulnerabilities for packages: dependency-track, gradle, opensearch, celeborn, trino, druid, kayenta-fips, kayenta, tez, hadoop-fips, wavefront-proxy, spdx-tools-java, hadoop-client-modules...

The vulnerability of the Gradle plugin for the Quarkus Java framework, which allows a hacker to exploit and disclose protected information

The vulnerability of the Gradle plugin for the Quarkus Java framework is related to the disclosure of information through environment variables. Exploiting this vulnerability allows an attacker to disclose the protected information...

MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries

Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate. "Access to projects can be hijacked through domain name purchases and since most default build configurations a...

CVE-2023-49238

In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation in certain installation scenarios because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in befor...

CVE-2023-49238

In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation in certain installation scenarios because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in befor...

CVE-2023-49238

In Gradle Enterprise before 2023.1, a non-unique initial system user password can allow a remote attacker to access a new installation in certain scenarios, potentially before the legitimate administrator logs in. This is classified as a high-severity issue (CVSS v3.1: CRITICAL) with network acce...

Gradle Security Vulnerabilities

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle Enterprise versions prior to 2023.1, which stems from an initial system user password that is not unique and could allow a remote attack...