Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
gradle enterprise vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2023-49238
In Gradle Enterprise prior to 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an a...
Gradle Enterprise
9.8
CVSSv3
CVE-2022-27919
Gradle Enterprise prior to 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.
Gradle Enterprise
9.8
CVSSv3
CVE-2021-41589
In Gradle Enterprise prior to 2021.3 (and Enterprise Build Cache Node prior to 10.0), there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration use...
Gradle Build Cache Node
Gradle Enterprise
9.8
CVSSv3
CVE-2019-11402
In Gradle Enterprise prior to 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format.
Gradle Enterprise
9.8
CVSSv3
CVE-2019-11403
In Gradle Enterprise prior to 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page.
Gradle Enterprise
Gradle Build Cache Node
8.8
CVSSv3
CVE-2020-15776
An issue exists in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An attacker with the ability to execute arbitrary code in a user's browser could impose an arbitrary value for this token, allow...
Gradle Enterprise
8.1
CVSSv3
CVE-2022-25364
In Gradle Enterprise prior to 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute ma...
Gradle Enterprise
8.1
CVSSv3
CVE-2021-41588
In Gradle Enterprise prior to 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys.
Gradle Gradle
7.8
CVSSv3
CVE-2020-15777
An issue exists in the Maven Extension plugin prior to 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an malicious user to achieve code execution via a malicious ...
Gradle Maven
7.5
CVSSv3
CVE-2022-41575
A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 up to and including 2022.3.3 allows remote malicious users to access a subset of application data (e.g., cleartext credentials). This is fixed in 2022.3.3.
Gradle Enterprise
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-33228
CVE-2024-20361
log injection
bypass
CVE-2024-4985
CVE-2024-35223
CVE-2024-29849
CVE-2024-31893
IMAP
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
NEXT »