Priority MEDIUM 50
ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04674 · Published 2017-02-07 · No fix listed CWE-502
Priority MEDIUM 49
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.07757 · Published 2020-10-01 · Partial fix · 1.10.9 CWE-379
Priority MEDIUM 47
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02925 · Published 2019-08-14 · No fix listed CWE-522
Priority MEDIUM 46
Gradle is a build tool with a focus on build automation.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.02709 · Published 2021-07-20 · Partial fix · 7.2 CWE-78
Priority MEDIUM 45
Gradle is a build tool with a focus on build automation and support for multi-language development.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00994 · Published 2023-03-02 · Partial fix · 6.9.4, 7.6.1 CWE-829
Priority MEDIUM 41
In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it.
CVSS 3.1HIGH 8.8· Local · Low privileges · No interaction · EPSS 0.00542 · Published 2021-04-13 · Partial fix · 7.0 CWE-378
Priority LOW 38
Gradle is a build tool with a focus on build automation and support for multi-language development.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.0132 · Published 2022-02-10 · Fixed in 7.4 CWE-829
Priority LOW 37
In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00796 · Published 2021-09-24 · No fix listed CWE-502
Priority LOW 37
In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning.
CVSS 3.1HIGH 8.0· Network · High privileges · No interaction · EPSS 0.01307 · Published 2021-04-13 · Partial fix CWE-829
Priority LOW 36
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.
CVSS 4.0HIGH 8.6· Network · No auth · User interaction · EPSS 0.00158 · Published 2026-01-16 · Fixed in 9.3.0 CWE-494
Priority LOW 36
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.
CVSS 4.0HIGH 8.6· Network · No auth · User interaction · EPSS 0.00174 · Published 2026-01-16 · Fixed in 9.3.0 CWE-494
Priority LOW 36
Gradle is a build tool with a focus on build automation and support for multi-language development.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00528 · Published 2023-06-30 · Partial fix · 7.6.1, 8.2 CWE-22
Priority LOW 35
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00934 · Published 2021-09-24 · No fix listed CWE-918
Priority LOW 35
Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Reque…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01309 · Published 2021-09-24 · No fix listed
Priority LOW 34
Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01377 · Published 2022-06-06 · No fix listed CWE-200
Priority LOW 34
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00781 · Published 2021-09-24 · No fix listed CWE-918
Priority LOW 32
Gradle is a build tool.
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.00557 · Published 2022-07-14 · Fix deferred CWE-829
Priority LOW 31
Gradle is a build tool with a focus on build automation and support for multi-language development.
CVSS 3.1MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.00781 · Published 2023-10-06 · Partial fix · 8.4, 7.6.3 CWE-611
Priority LOW 30
Gradle is a build tool with a focus on build automation and support for multi-language development.
CVSS 3.1MEDIUM 6.9· Local · No auth · User interaction · EPSS 0.00283 · Published 2023-06-30 · Partial fix · 7.6.2, 8.2 CWE-22
Priority LOW 29
Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0136 · Published 2019-04-09 · Partial fix · 5.4.0 CWE-319
Priority LOW 28
Gradle is a build tool with a focus on build automation and support for multi-language development.
CVSS 3.1MEDIUM 6.5· Local · Low privileges · No interaction · EPSS 0.00222 · Published 2023-10-05 · Partial fix · 7.6.3, 8.4.0 CWE-732
Priority LOW 28
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-490…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00891 · Published 2019-09-16 · Partial fix · 6.0 CWE-327
Priority LOW 25
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00484 · Published 2021-04-12 · Partial fix · 7.0 CWE-377
THREATIST.IORead the docs