Vulnerabilities

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.

Gradle is a build tool with a focus on build automation and support for multi-language development.

Gradle is a build tool with a focus on build automation and support for multi-language development.

Gradle is a build tool with a focus on build automation and support for multi-language development.

Gradle is a build tool with a focus on build automation and support for multi-language development.

Gradle is a build tool with a focus on build automation and support for multi-language development.

Gradle is a build tool.

Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.

Gradle is a build tool with a focus on build automation and support for multi-language development.

In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.

In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects.

Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Reque…

Gradle is a build tool with a focus on build automation.

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning.

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it.

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle.

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them.

The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-490…

The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host.

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used.

ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.