Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
sonatype vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2024-4956
Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated malicious user to read system files. Fixed in version 3.68.1.
18 Github repositories
NA
CVE-2024-1142
Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated malicious users to overwrite or delete files via a specially crafted request. Version 171 fixes this issue.
4
CVSSv2
CVE-2022-27907
Sonatype Nexus Repository Manager 3.x prior to 3.38.0 allows SSRF.
Sonatype Nexus Repository Manager
4.3
CVSSv2
CVE-2021-43961
Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.
Sonatype Nexus Repository Manager
4
CVSSv2
CVE-2021-43293
Sonatype Nexus Repository Manager 3.x prior to 3.36.0 allows a remote authenticated malicious user to potentially perform network enumeration via Server Side Request Forgery (SSRF).
Sonatype Nexus Repository Manager
4
CVSSv2
CVE-2021-42568
Sonatype Nexus Repository Manager 3.x up to and including 3.35.0 allows malicious users to access the SSL Certificates Loading function via a low-privileged account.
Sonatype Nexus Repository Manager
6.4
CVSSv2
CVE-2021-40143
Sonatype Nexus Repository 3.x up to and including 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
Sonatype Nexus Repository Manager 3
3.5
CVSSv2
CVE-2021-37152
Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 prior to 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications.
Sonatype Nexus Repository Manager
4
CVSSv2
CVE-2021-34553
Sonatype Nexus Repository Manager 3.x prior to 3.31.0 allows a remote authenticated malicious user to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.
Sonatype Nexus Repository Manager
4.3
CVSSv2
CVE-2021-29159
A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x prior to 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of t...
Sonatype Nexus Repository Manager
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
buffer overflow
type confusion
server-side request forgery
CVE-2024-38440
CVE-2024-27801
CVE-2024-5868
CVE-2024-0582
CVE-2024-37643
CVE-2024-3105
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »