CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42661 – JFrog Artifactory Improper input validation leads to arbitrary file write
https://notcve.org/view.php?id=CVE-2023-42661
JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts. JFrog Artifactory anterior a la versión 7.76.2 es vulnerable a la escritura arbitraria de archivos de datos que no son de confianza, lo que puede provocar DoS o ejecución remota de código cuando un usuario autenticado envía una serie de solicitudes especialmente manipuladas. Esto se debe a una validación insuficiente de los artefactos. • https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-42662 – JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens
https://notcve.org/view.php?id=CVE-2023-42662
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration. Las versiones de JFrog Artifactory 7.59 y superiores, pero inferiores a 7.59.18, 7.63.18, 7.68.19, 7.71.8 son vulnerables a un problema por el cual la interacción del usuario con URL especialmente manipuladas podría provocar la exposición de los tokens de acceso del usuario debido a un manejo inadecuado del Integración SSO basada en navegador CLI/IDE. • https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42508 – JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform
https://notcve.org/view.php?id=CVE-2023-42508
JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body. JFrog Artifactory anterior a la versión 7.66.0 es vulnerable a abusos específicos en el endpoints con un payload especialmente manipulado, lo que puede llevar a que usuarios no autenticados puedan enviar correos electrónicos con cuerpos manipulados. • https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-0668
https://notcve.org/view.php?id=CVE-2022-0668
JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user. JFrog Artifactory anterior a 7.37.13 es vulnerable a la omisión de autenticación, lo que puede provocar una escalada de privilegios cuando un usuario no autenticado envía una solicitud especialmente manipulada. • https://www.jfrog.com/confluence/display/JFROG/CVE-2022-0668%3A+Artifactory+Authentication+Bypass • CWE-269: Improper Privilege Management CWE-274: Improper Handling of Insufficient Privileges •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-23163
https://notcve.org/view.php?id=CVE-2021-23163
JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x. JFrog Artifactory versiones anteriores a 7.33.6 y 6.23.38, es vulnerable a un ataque de tipo CSRF ( Cross-Site Request Forgery) para endpoints específicos. Este problema afecta a: JFrog JFrog Artifactory JFrog versiones anteriores a 7.33.6 versiones anteriores a 7.x; JFrog Artifactory versiones anteriores a 6.23.38 versiones anteriores a 6.x • https://www.jfrog.com/confluence/display/JFROG/CVE-2021-23163%3A++Cross-Site+Request+Forgery+on+REST+using+Basic+Auth https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories • CWE-352: Cross-Site Request Forgery (CSRF) •