45 matches found
CVE-2021-45721
CVE-2021-45721 affects JFrog Artifactory. Vulnerable through Reflected XSS in a Users REST API XHR parameter due to insufficient input validation. Affected versions: before 7.29.8 and before 6.23.38. Impact: potential client-side JavaScript execution. Remediation (as documented): upgrade to 7.29....
CVE-2021-46687
CVE-2021-46687 affects JFrog Artifactory: versions prior to 7.31.10 and prior to 6.23.38 are vulnerable to sensitive data exposure through the Project Administrator REST API . The underlying issue is exposed in the REST API and leads to leakage of sensitive data in affected releases. The provided...
CVE-2019-10323
The CVE-2019-10323 issue affects the Jenkins Artifactory Plugin (notably 3.2.0/3.2.1 and earlier up to 3.2.3), where doFillCredentialsIdItems lacks proper permission checks. This allows any user with Overall/Read access to enumerate credential IDs in Jenkins, causing information disclosure of sto...
CVE-2019-10322
CVE-2019-10322 affects the Jenkins Artifactory Plugin (3.2.2 and earlier). The vulnerability is due to a missing permission check in the ArtifactoryBuilder.doTestConnection endpoint, allowing any user with Overall/Read access to connect to an attacker-controlled URL using attacker-provided creden...
CVE-2019-10324
CVE-2019-10324 concerns the Jenkins Artifactory Plugin (versions 3.2.2 and earlier). The vulnerability is a cross-site request forgery (CSRF) affecting multiple release-related actions: ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBu...
CVE-2019-10321
The vulnerability CVE-2019-10321 affects the Jenkins Artifactory Plugin (notably versions 3.2.0–3.2.2) via the ArtifactoryBuilder.DescriptorImpl.doTestConnection endpoint. The root cause is missing permission checks and CSRF protection on the testConnection flow, allowing users with Overall/Read ...
CVE-2019-9733
JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass: an unauthenticated user can exploit the X-Forwarded-For header to login as the admin by abusing the access-admin reset path, bypassing IP whitelists and potentially obtaining tokens to control all artifacts and repositories. Root cau...
CVE-2019-17444
Jfrog Artifactory prior to 6.17.0 uses default admin passwords (e.g., “password”) and does not require users to change them, enabling network-based attackers to fully compromise the instance. The issue affects Artifactory versions before 6.17.0. Remediation documented in connected sources: upgrad...
CVE-2022-0573
Affected product: JFrog Artifactory (versions before 7.36.1 and before 6.23.41). The root cause is insecure deserialization of untrusted data in a user-provided serialized object. Consequences described across sources include Denial of Service, Privilege Escalation, and Remote Code Execution when...
CVE-2022-0668
JFrog Artifactory is affected by CVE-2022-0668 through versions prior to 7.37.13. The issue is an authentication bypass that could enable privilege escalation when an unauthenticated user sends a specially crafted request. Affected software: Artifactory (JFrog). Root cause: authentication bypass ...
CVE-2021-45074
CVE-2021-45074 affects JFrog Artifactory prior to version 7.29.3 and prior to 6.23.38. The issue is a Broken Access Control where a low-privileged user can delete other known users’ OAuth tokens, forcing reauthentication on an active session or the next UI session. Connected sources include Red H...
CVE-2021-46270
CVE-2021-46270 affects JFrog Artifactory prior to version 7.31.10. The issue is a Broken Access Control where a project admin user can list all repository names due to insufficient permission validation. Impact is limited to the ability to enumerate repositories; no other data exposure is specifi...
CVE-2021-3860
Affected software : JFrog Artifactory before 7.25.4 (Enterprise+ deployments). Vulnerability : Blind SQL Injection by a low-privileged authenticated user due to incomplete validation when performing SQL queries. Impact : as described in multiple sources (high-severity CVSS in 3.1 context, partial...
CVE-2023-42508
CVE-2023-42508 : JFrog Artifactory versions prior to 7.66.0 are affected by an endpoint abuse vulnerability that allows unauthenticated users to send emails with manipulated email bodies via a crafted payload. Root cause described as improper header input validation leading to email manipulation....
CVE-2020-7931
In Artifactory 5.x–6.x, insecure FreeMarker template processing allows remote code execution. The root cause is the DefaultObjectWrapper exposing Java functions to templates, enabling actions such as modifying a user’s .ssh/authorized_keys. Affected versions range from 5.11.8 to 6.16.0, with patc...
CVE-2021-45730
Affected product: JFrog Artifactory prior to 7.31.10. Vulnerability: Broken Access Control allows a Project Admin to create, edit, and delete Repository Layouts, which should be restricted to Platform Administrators. Root cause (per sources): improper access control for Repository Layouts configu...
CVE-2021-41834
JFrog Artifactory is affected in versions prior to 7.28.0 and 6.23.38 by a Broken Access Control flaw that allows a low-privileged user to read and copy any artifact via the copy functionality due to improper permissions validation. The issue is documented across multiple sources (including Red H...
CVE-2026-65617
Technical details (affected component, exact root cause, affected versions, exploitability) are not publicly provided in the supplied documents. Monitor for updates.
CVE-2024-2247
JFrog Artifactory is affected by a DOM-based cross-site scripting vulnerability in versions prior to 7.77.7 and 7.82.1, caused by improper handling of the import override mechanism. Impact: potential cross-site scripting via the vulnerable import override path. Affected software is Artifactory (A...
CVE-2024-3505
CVE-2024-3505 affects JFrog Artifactory Self-Hosted: versions prior to 7.77.3 are vulnerable to information disclosure where a low-privileged authenticated user can read the proxy configuration. The issue does not impact JFrog cloud deployments. Remediation: upgrade to 7.77.3 or later (as stated ...
CVE-2020-2164
Affected software: Jenkins Artifactory Plugin 3.5.0 and earlier. Root cause: Artifactory server password stored in plaintext in the plugin’s global configuration (e.g., org.jfrog.hudson.ArtifactoryBuilder.xml) on the Jenkins master/controller file system. Impact: password exposure to users with a...
CVE-2023-42661
JFrog Artifactory before version 7.76.2 is affected by an Arbitrary File Write vulnerability due to insufficient validation of artifacts. The issue allows an authenticated user to cause DoS or Remote Code Execution by sending a specially crafted sequence of requests. Affected product: JFrog Artif...
CVE-2021-23163
CVE-2021-23163 affects JFrog Artifactory. Multiple connected sources confirm a CSRF vulnerability on specific endpoints in Artifactory versions before 7.33.6 and before 6.23.38. The root cause is described as a CSRF issue; exploit details are not provided in the documents. Remediation: upgrade to...
CVE-2023-42509
JFrog Artifactory versions >7.17.4 and
CVE-2023-42662
CVE-2023-42662 (JFrog Artifactory) affects Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, and 7.71.8. The issue arises from improper handling of the CLI/IDE browser-based SSO integration, allowing user interaction with specially crafted URLs to expose user access tokens...
CVE-2019-19937
The vulnerability concerns JFrog Artifactory before version 6.18, where there is no ability to restrict system or repository imports by any admin user in the enterprise. This lack enables “undesirable results” as described in CVE-2019-19937. The connected documents consistently identify Artifacto...
CVE-2020-2165
The CVE-2020-2165 issue affects the Jenkins Artifactory Plugin and is caused by transmitting passwords in plain text through the global Jenkins configuration form for versions 3.6.0 and earlier, potentially exposing credentials (e.g., via browser extensions or related vectors). The problem is spe...
CVE-2016-10036
CVE-2016-10036 affects JFrog Artifactory
CVE-2018-1000623
CVE-2018-1000623 affects JFrog Artifactory: versions prior to 6.0.3 (since 4.0.0) contain a Directory Traversal vulnerability in the “Import Repository from Zip” UI path. The vulnerable endpoint is exposed at /ui/artifactimport/upload and, via a Zip Slip flaw, can lead to directory traversal, fil...
CVE-2026-66018
CVE-2026-66018 affects JFrog Artifactory: Build readers can access another repository's environment properties by selecting a readable repository parameter when retrieving environment properties for a protected build, exposing build environment secrets. Impact is confidentiality only (no integrit...
CVE-2018-1000206
JFrog Artifactory v5.11+ contains a UI REST CSRF vulnerability enabling actions as a logged-in user. The attack is described as a Classic CSRF likely exploitable via a crafted Flash component. Affected component: UI REST endpoints; root cause: Cross-Site Request Forgery. Impact: unauthorized acti...
CVE-2018-1000424
The CVE affects Jenkins Artifactory Plugin up to version 2.16.1, where ArtifactoryBuilder.java and CredentialsConfig.java stored old credentials in an insufficiently protected form before integration with the Credentials Plugin. The vulnerability allows attackers with local filesystem access to o...
CVE-2018-19971
The CVE-2018-19971 entry applies to JFrog Artifactory Pro SAML SSO addon. Patreon details from PacketStorm show Artifactory Pro 6.5.9 is vulnerable due to improper validation of the XML signature in the SAMLResponse sent to /webapp/saml/loginRespo (SAML SSO integration). This allows an attacker t...
CVE-2016-6501
JFrog Artifactory before 4.11 is affected by an LDAP entry poisoning vulnerability where an LDAP attribute containing a crafted serialized Java object enables remote code execution. The issue is triggered via LDAP processing and allows an attacker to execute arbitrary code on the server. Public r...
CVE-2026-65923
The CVE-2026-65923 entry documents a URL validation weakness in JFrog Artifactory Ansible repository handling that could, under specific repository access conditions, trigger unintended server-side requests. Affected component: Artifactory’s Ansible repository handling (details align with Artifac...
CVE-2026-65618
CVE-2026-65618 describes an SSRF risk in JFrog Artifactory due to improper URL validation when handling certain URLs. The vulnerability could allow an attacker to cause unauthorized requests from Artifactory, potentially exposing internal services and cached response data. Affected component is A...
CVE-2026-66015
CVE-2026-66015 /JFrog Platform: An authenticated privilege-escalation via an authorization flaw under admin-provisioned accounts could grant temporary platform administrator access. Documented as an authenticated threat with HIGH impact (confidentiality, integrity, availability). No specific expl...
CVE-2026-65925
CVE-2026-65925 describes a Server-Side Request Forgery (SSRF) in JFrog Artifactory when using the Cargo remote repository. A user with read access to the Cargo remote repository could cause Artifactory to request unintended URLs and return the response. The CVSS 3.1 vector is NETWORK, PRIVILEGES ...
CVE-2026-66014
Technical details (affected product versions, root cause specifics, impact scope, and fixes) are not publicly available in the provided documents. Monitor for updates from official advisories and vendor communications.
CVE-2026-65924
JFrog Artifactory's Terraform remote repository support is affected by a Server-Side Request Forgery (SSRF) vulnerability. An authenticated user, or an unauthenticated user if anonymous access is enabled, can cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive ...
CVE-2026-65922
Technical details for CVE-2026-65922 are not publicly provided in the supplied documents; monitor for updates.
CVE-2026-42016
Affected software : JFrog Artifactory (Self Hosted), prior to version 7.133.11. Vulnerability : Incorrect validation of the user token allows privilege escalation; the underlying issue is validating the token signature/issuer rather than the token’s scope. Impact : Privilege escalation with high ...
CVE-2026-65616
The provided documents describe CVE-2026-65616 as an incorrect authorization validation in the refresh token signature that allows non-admin users to obtain a signed JFrog administrator token. This indicates a privilege escalation risk tied to the token signing/validation flow in the JFrog produc...