CVE-2020-37020 SonarQube 8.3.1 - Unquoted Service Path

SonarQube 8.3.1 contains an unquoted service path vulnerability that allows local attackers to gain SYSTEM privileges by exploiting the service executable path. Attackers can replace the wrapper.exe in the service path with a malicious executable to execute code with highest system privileges...

PT-2026-5293

SonarQube 8.3.1 contains an unquoted service path vulnerability that allows local attackers to gain SYSTEM privileges by exploiting the service executable path. Attackers can replace the wrapper.exe in the service path with a malicious executable to execute code with highest system privileges...

SonarQube code issues and vulnerabilities

SonarQube is an open-source code inspection tool developed by Sonar. Version SonarQube 8.3.1 has a code-related vulnerability. This vulnerability stems from the lack of quotation marks around service paths, which may allow local attackers to gain SYSTEM privileges...

CVE-2025-68384 vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch...

GHSA-QF7C-7R9H-MM92 vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch...

GHSA-67MF-3CR5-8W23 vulnerabilities

Vulnerabilities for packages: sonarqube, cassandra, opensearch...

CVE-2025-8885 vulnerabilities

Vulnerabilities for packages: sonarqube, cassandra, opensearch...

GHSA-QF7C-7R9H-MM92 vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch, elasticsearch-fips...

CVE-2025-68384 vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch, elasticsearch-fips...

CVE-2025-37731 vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch...

GHSA-M9GH-789G-Q5PV vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch...

GHSA-M9GH-789G-Q5PV vulnerabilities

Vulnerabilities for packages: sonarqube, conductor-fips, elasticsearch-fips, conductor, ruby4.0-elasticsearch...

CVE-2025-37731 vulnerabilities

Vulnerabilities for packages: sonarqube, conductor-fips, elasticsearch-fips, conductor, ruby4.0-elasticsearch...

CVE-2025-68390 vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch...

GHSA-GPHJ-4H6P-37XQ vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch...

CVE-2025-68390 vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch, elasticsearch-fips...

GHSA-GPHJ-4H6P-37XQ vulnerabilities

Vulnerabilities for packages: sonarqube, ruby4.0-elasticsearch, elasticsearch-fips...

CVE-2025-62292

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts...

CVE-2025-62292

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts...

CVE-2025-62292

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts...