Sonatype

Records91All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high39CVSS 7.0–8.9

Exploited now

Sonatype records in CISA KEV

TI-2019-05133 Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability CRITICAL 100KEV 2021-12-10 TI-2020-08218 Sonatype Nexus Repository Remote Code Execution Vulnerability CRITICAL 97KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records

Nexus Repository Manager 64 records CRITICAL Nexus 8 records CRITICAL Nexus Iq Server 1 record LOW

Records

8 records in Nexus · all components

TI-2020-08218 CVE-2020-10199 · GHSA-g2f6-v5qh-h2mq

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

CRITICAL 97KEV

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.99064 Published 2020-04-01 Fixed in 3.21.2 CWE-917

TI-2020-08220 CVE-2020-10204 · GHSA-8h56-v53h-5hhj

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

MEDIUM 59

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.38423 Published 2020-04-01 Fixed in 3.21.2 CWE-20

TI-2020-09183 CVE-2020-11444 · GHSA-hpj4-6rw5-wq8w

Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.

MEDIUM 49

Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.08508 Published 2020-04-02 No fix listed CWE-276

TI-2014-00735 CVE-2014-0792 · GHSA-6hg7-jppj-fgrc

Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary…

LOW 38

Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03049 Published 2014-01-17 No fix listed CWE-94

TI-2014-07618 CVE-2014-9389 · GHSA-jc87-9gpj-7hq5

Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows…

LOW 37

Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01895 Published 2015-01-05 No fix listed CWE-22

TI-2014-01597 CVE-2014-2034 · GHSA-85wj-qmr7-vwpw

Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows…

LOW 37

Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path."

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02062 Published 2014-04-01 No fix listed

TI-2020-15094 CVE-2020-24622 · GHSA-jmpm-4h56-g275

In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.

LOW 24

In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00992 Published 2020-08-25 No fix listed CWE-522

TI-2020-08219 CVE-2020-10203 · GHSA-3944-787c-f852

Sonatype Nexus Repository before 3.21.2 allows XSS.

LOW 24

Sonatype Nexus Repository before 3.21.2 allows XSS.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00918 Published 2020-04-01 Fixed in 3.21.2 CWE-79

Open these records in search →