CVE-2018-19413

CVE-2018-19413 affects the SonarSource SonarQube API. An authenticated non-admin user could access the externalIdentity field due to improperly configured access controls, enabling disclosure of valid user login names. Affected versions include SonarQube up to 7.4 (and 7.5+ fixes referenced in re...

CVE-2019-17579

CVE-2019-17579 affects SonarSource SonarQube versions prior to 7.8. The vulnerability is a cross-site scripting (XSS) flaw in the project links on account/projects, arising from insufficient validation of client-side data in the WEB application. Impact described in sources: attacker could potenti...

CVE-2024-38460

CVE-2024-38460 affects SonarQube before 10.4 and 9.9.4 LTA. The issue is that values encrypted via Settings Encryption can be exposed in cleartext in URL parameters found in logs (e.g., access logs, proxy logs). The root cause is insecure handling of encrypted values in log output, enabling poten...