312 matches found
CVE-2019-9733
An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a...
CVE-2019-9733
JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass: an unauthenticated user can exploit the X-Forwarded-For header to login as the admin by abusing the access-admin reset path, bypassing IP whitelists and potentially obtaining tokens to control all artifacts and repositories. Root cau...
JFrog Artifactory Administrator Authentication Bypass Exploit
JFrog Artifactory versions prior to 6.8.7 suffer from an administrative access bypass vulnerability due to relying on an X-Forwarded-For header. JFrog Artifactory Administrator Authentication Bypass Introduction ============ JFrog Artifactory https://jfrog.com/artifactory/ is a popular universal...
JFrog Artifactory Administrator Authentication Bypass
CipherTechs Inc - Security Advisory JFrog Artifactory Administrator Authentication Bypass Introduction ============ JFrog Artifactory https://jfrog.com/artifactory/ is a popular universal artifact repository manager commonly used by software developers. CipherTechs' Red Team discovered a high ris...
JFrog Artifactory Pro 6.5.9 Signature Validation
CVE-2018-19971: JFrog Artifactory Pro SAML SSO signature validation error ------------------------------------------------------------------------- Affected products ================= The SAML SSO addon in Artifactory 6.5.9 is vulnerable. The SAML SSO addon in Artifactory 6.5.13 is NOT vulnerable...
CVE-2018-1000206
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery CSRF vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flas...
CVE-2018-1000206
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery CSRF vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flas...
Cross site request forgery (csrf)
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery CSRF vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flas...
CVE-2018-1000206
JFrog Artifactory v5.11+ contains a UI REST CSRF vulnerability enabling actions as a logged-in user. The attack is described as a Classic CSRF likely exploitable via a crafted Flash component. Affected component: UI REST endpoints; root cause: Cross-Site Request Forgery. Impact: unauthorized acti...
CVE-2018-1000206
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery CSRF vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flas...
CVE-2018-1000623
JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu - Import & Export - Repositories, triggers a vulnerable UI REST endpoint /ui/artifactimport/upload...
Directory traversal
JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu - Import & Export - Repositories, triggers a vulnerable UI REST endpoint /ui/artifactimport/upload...
CVE-2018-1000623
JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu - Import & Export - Repositories, triggers a vulnerable UI REST endpoint /ui/artifactimport/upload...
CVE-2018-1000623
JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu - Import & Export - Repositories, triggers a vulnerable UI REST endpoint /ui/artifactimport/upload...
CVE-2018-1000623
CVE-2018-1000623 affects JFrog Artifactory: versions prior to 6.0.3 (since 4.0.0) contain a Directory Traversal vulnerability in the “Import Repository from Zip” UI path. The vulnerable endpoint is exposed at /ui/artifactimport/upload and, via a Zip Slip flaw, can lead to directory traversal, fil...
JFrog Artifactory Arbitrary File Upload Vulnerability
JFrog Artifactory is an open source, general-purpose Artifact repository manager from Israel's JFrog that supports clustering and high-availability Docker registries and provides an end-to-end automation solution for tracking artifacts from development to production. An arbitrary file upload...
CVE-2016-10036
Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to 1 deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or 2 possibly write to arbitrary files and cause a denial of service by uploading a...
Unrestricted file upload
Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to 1 deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or 2 possibly write to arbitrary files and cause a denial of service by uploading a...
CVE-2016-10036
Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to 1 deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or 2 possibly write to arbitrary files and cause a denial of service by uploading a...