Page 5 of 37 results (0.004 seconds)

CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0

CVE-2020-11415

https://notcve.org/view.php?id=CVE-2020-11415

An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext. Se detectó un problema en Sonatype Nexus Repository Manager versiones 2.x versiones anteriores a 2.14.17 y versiones 3.x versiones anteriores a 3.22.1. Los usuarios administradores pueden recuperar el nombre de usuario y contraseña del sistema del servidor LDAP (tal como está configurado en nxrm) en texto sin cifrar. • https://support.sonatype.com/hc/en-us/articles/360045360854 • CWE-312: Cleartext Storage of Sensitive Information •

CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2020-11753

https://notcve.org/view.php?id=CVE-2020-11753

An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable). Se descubrió un problema en Sonatype Nexus Repository Manager en las versiones 3.21.1 y 3.22.0. Es posible que un usuario con los privilegios apropiados cree, modifique y ejecute tareas scripting sin utilizar la Interfaz de Usuario o la API. • https://cwe.mitre.org/data/definitions/284.html https://support.sonatype.com/hc/en-us/articles/360046233714 • CWE-863: Incorrect Authorization •

CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1

CVE-2019-15588

https://notcve.org/view.php?id=CVE-2019-15588

There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability. Se presenta una Inyección de Comandos de Sistema Operativo en Nexus Repository Manager versiones anteriores a 2.14.14 incluyéndola (omite el CVE-2019-5475) lo que podría permitir a un atacante una Ejecución de Código Remota. Todas las instancias del archivo CommandLineExecutor.java con datos suministrados por el usuario son vulnerables, tal y como la Yum Configuration Capability. • https://github.com/EXP-Docs/CVE-2019-15588 https://hackerone.com/reports/688270 https://support.sonatype.com/hc/en-us/articles/360033490774-CVE-2019-5475-Nexus-Repository-Manager-2-OS-Command-Injection-2019-08-09 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2019-16530

https://notcve.org/view.php?id=CVE-2019-16530

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution. Sonatype Nexus Repository Manager versiones 2.x anteriores a 2.14.15 y versiones 3.x anteriores a 3.19, y IQ Server versiones anteriores a 72, presenta una ejecución de código remota. • https://issues.sonatype.org/secure/ReleaseNote.jspa https://support.sonatype.com/hc/en-us/articles/360036132453 • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0

CVE-2019-15893

https://notcve.org/view.php?id=CVE-2019-15893

Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution. Sonatype Nexus Repository Manager versiones 2.x anteriores a 2.14.15, permite la ejecución de código remota. • https://support.sonatype.com/hc/en-us/articles/360035055794 •