Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
80 results · page 2 of 2
Apr 23, 2021Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.CVE-2021-29158 · Other software · Sonatype · reported by MITREMedium 4.9
Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Dec 16, 2020Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via anCVE-2020-29436 · Other software · Sonatype · reported by MITREMedium 6.5
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Oct 12, 2020A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19.CVE-2020-15012 · Other software · Sonatype · reported by MITREHigh 8.6
A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to).
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Aug 25, 2020In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.CVE-2020-24622 · Other software · Sonatype · reported by MITREMedium 4.9
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.
- Product
- Nexus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.sonatype.orgsupport.sonatype.com
Aug 12, 2020Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.CVE-2020-15868 · Other software · Sonatype · reported by MITREHigh 7.5
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Jul 31, 2020Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.CVE-2020-15871 · Other software · Sonatype · reported by MITREHigh 8.8
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Jul 31, 2020Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).CVE-2020-15870 · Other software · Sonatype · reported by MITREMedium 6.1
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Jul 31, 2020Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).CVE-2020-15869 · Other software · Sonatype · reported by MITREMedium 5.4
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Apr 27, 2020An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1.CVE-2020-11415 · Other software · Sonatype · reported by MITREMedium 4.9
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Apr 20, 2020An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0.CVE-2020-11753 · Other software · Sonatype · reported by MITREHigh 8.8
An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgsupport.sonatype.com
Apr 2, 2020Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.CVE-2020-11444 · Other software · Sonatype · reported by MITREHigh 8.8
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
- Product
- Nexus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Apr 1, 2020Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.CVE-2020-10204 · Other software · Sonatype · reported by MITREHigh 7.2
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
- Product
- Nexus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Apr 1, 2020Sonatype Nexus Repository before 3.21.2 allows XSS.CVE-2020-10203 · Other software · Sonatype · reported by MITREMedium 4.8
Sonatype Nexus Repository before 3.21.2 allows XSS.
- Product
- Nexus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Apr 1, 2020Sonatype Nexus Repository Remote Code Execution VulnerabilityCVE-2020-10199 · Other software · Sonatype · reported by MITREExploitedHigh 8.8
Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.
- Product
- Nexus Repository
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Sonatype’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Nov 1, 2019There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE).CVE-2019-15588 · Other software · Sonatype · reported by support@hackerone.comHigh 7.2
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comsupport.sonatype.com
Oct 21, 2019Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.CVE-2019-16530 · Other software · Sonatype · reported by MITREHigh 7.2
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
- Product
- Nexus IQ Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.sonatype.orgsupport.sonatype.com
Oct 16, 2019Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.CVE-2019-15893 · Other software · Sonatype · reported by MITREHigh 7.2
Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Sep 3, 2019The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such asCVE-2019-5475 · Other software · Sonatype · reported by support@hackerone.comHigh 8.8
The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Aug 22, 2019In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.CVE-2019-14469 · Other software · Sonatype · reported by MITREMedium 5.4
In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Jul 8, 2019Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.CVE-2019-9630 · Other software · Sonatype · reported by MITREHigh 7.5
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwistlock.comtwistlock.com
Jul 8, 2019Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).CVE-2019-9629 · Other software · Sonatype · reported by MITRECritical 9.8
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwistlock.comtwistlock.com
May 7, 2019Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.CVE-2019-11629 · Other software · Sonatype · reported by MITREMedium 6.1
Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Mar 21, 2019Sonatype Nexus Repository Manager Incorrect Access Control VulnerabilityCVE-2019-7238 · Other software · Sonatype · reported by MITREExploitedCritical 9.8
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
- Product
- Nexus Repository Manager
- On CISA’s list since
- Dec 10, 2021 (federal fix deadline Jun 10, 2022)
- What to do
- Attackers are using this now. Install Sonatype’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.sonatype.comsupport.sonatype.com
Nov 15, 2018Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.CVE-2018-16621 · Other software · Sonatype · reported by MITREHigh 7.2
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsupport.sonatype.com
Nov 15, 2018Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.CVE-2018-16620 · Other software · Sonatype · reported by MITREHigh 7.5
Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Nov 15, 2018Sonatype Nexus Repository Manager before 3.14 allows XSS.CVE-2018-16619 · Other software · Sonatype · reported by MITREMedium 6.1
Sonatype Nexus Repository Manager before 3.14 allows XSS.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sonatype.comsupport.sonatype.com
Jun 11, 2018Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.CVE-2018-12100 · Other software · Sonatype · reported by MITREMedium 4.8
Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.sonatype.comissues.sonatype.org
Feb 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitraryCVE-2018-5307 · Other software · Sonatype · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.sonatype.com
Feb 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary weCVE-2018-5306 · Other software · Sonatype · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.sonatype.com
Dec 17, 2017Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.CVE-2017-17717 · Other software · Sonatype · reported by MITRECritical 9.8
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.