gradle

In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password.

ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them.

In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the build cache node with its default configuration.

The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host.

Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file.

Gradle is a build tool with a focus on build automation.

Gradle is a build tool with a focus on build automation and support for multi-language development.

In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format.

In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page.

An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4.

A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of application data (e.g., cleartext credentials).

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it.

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.

gradle-completion provides Bash and Zsh completion support for Gradle.

Gradle is a build tool with a focus on build automation and support for multi-language development.

Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user.

In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access.

An issue was discovered in Gradle Enterprise before 2021.1.2.

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects.

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning.

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.

Gradle is a build tool with a focus on build automation and support for multi-language development.

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise.