JFrog Artifactory Input Validation Error Vulnerability

JFrog Artifactory is an open source, general-purpose Artifact repository manager from Israel's JFrog that supports clustering and high-availability Docker registries, and provides an end-to-end solution for automating the tracking of artifacts from development to production. An input validation...

JFrog Artifactory FreeMarker Template Injection Vulnerability

Artifactory is a full-featured component manager from JFrog. A template injection vulnerability exists in Artifactory FreeMarker, which can be exploited by an attacker to An attacker can use this vulnerability to read or write arbitrary files and execute code on an instance of Artifactory...

CVE-2019-19937

In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."...

CVE-2019-19937

In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."...

Design/Logic Flaw

In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."...

CVE-2019-19937

In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."...

CVE-2019-19937

The vulnerability concerns JFrog Artifactory before version 6.18, where there is no ability to restrict system or repository imports by any admin user in the enterprise. This lack enables “undesirable results” as described in CVE-2019-19937. The connected documents consistently identify Artifacto...

CVE-2020-7931

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorizedkeys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certa...

Input validation

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorizedkeys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certa...

CVE-2020-7931

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorizedkeys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certa...

CVE-2020-7931

In Artifactory 5.x–6.x, insecure FreeMarker template processing allows remote code execution. The root cause is the DefaultObjectWrapper exposing Java functions to templates, enabling actions such as modifying a user’s .ssh/authorized_keys. Affected versions range from 5.11.8 to 6.16.0, with patc...

Internet Bug Bounty: Industry-Wide MITM Vulnerability Impacting the JVM Ecosystem

I've been exploring the industry-wide scope of the use of HTTP to resolve dependencies in build infrastructure across the industry. What I unearthed was that some of the most popular libraries and two compilers were impacted by this vulnerability. Vulnerability CWE-829: Inclusion of Functionality...

CVE-2018-19971

JFrog Artifactory Pro 6.5.9 has Incorrect Access Control...

Improper access control

JFrog Artifactory Pro 6.5.9 has Incorrect Access Control...

CVE-2018-19971

JFrog Artifactory Pro 6.5.9 has Incorrect Access Control...

CVE-2018-19971

The CVE-2018-19971 entry applies to JFrog Artifactory Pro SAML SSO addon. Patreon details from PacketStorm show Artifactory Pro 6.5.9 is vulnerable due to improper validation of the XML signature in the SAMLResponse sent to /webapp/saml/loginRespo (SAML SSO integration). This allows an attacker t...

CVE-2018-19971

JFrog Artifactory Pro 6.5.9 has Incorrect Access Control...

CVE-2019-9733

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a...

CVE-2019-9733

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a...

Design/Logic Flaw

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a...