CVSS: 9.0EPSS: 97%CPEs: 1EXPL: 7CVE-2020-10199 – Sonatype Nexus Repository Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10199
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). Sonatype Nexus Repository versiones anteriores a 3.21.2, permite una inyección JavaEL (problema 1 de 2). Sonatype Nexus version 3.21.1 suffers from an authenticated remote code execution vulnerability. Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution. • https://www.exploit-db.com/exploits/49385 https://www.exploit-db.com/exploits/48343 https://github.com/jas502n/CVE-2020-10199 https://github.com/aleenzz/CVE-2020-10199 https://github.com/wsfengfan/CVE-2020-10199-10204 https://github.com/hugosg97/CVE-2020-10199-Nexus-3.21.01 http://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html http://packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html https:/ • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 1CVE-2020-10204
https://notcve.org/view.php?id=CVE-2020-10204
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. Sonatype Nexus Repository versiones anteriores a 3.21.2, permite una ejecución de código remota. • https://github.com/zhzyker/CVE-2020-10204 https://support.sonatype.com/hc/en-us/articles/360044356194 • CWE-20: Improper Input Validation •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10203
https://notcve.org/view.php?id=CVE-2020-10203
Sonatype Nexus Repository before 3.21.2 allows XSS. Sonatype Nexus Repository versiones anteriores a 3.21.2, permite un ataque de tipo XSS. • https://support.sonatype.com/hc/en-us/articles/360044361594 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15588
https://notcve.org/view.php?id=CVE-2019-15588
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability. Se presenta una Inyección de Comandos de Sistema Operativo en Nexus Repository Manager versiones anteriores a 2.14.14 incluyéndola (omite el CVE-2019-5475) lo que podría permitir a un atacante una Ejecución de Código Remota. Todas las instancias del archivo CommandLineExecutor.java con datos suministrados por el usuario son vulnerables, tal y como la Yum Configuration Capability. • https://github.com/EXP-Docs/CVE-2019-15588 https://hackerone.com/reports/688270 https://support.sonatype.com/hc/en-us/articles/360033490774-CVE-2019-5475-Nexus-Repository-Manager-2-OS-Command-Injection-2019-08-09 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2019-16530
https://notcve.org/view.php?id=CVE-2019-16530
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution. Sonatype Nexus Repository Manager versiones 2.x anteriores a 2.14.15 y versiones 3.x anteriores a 3.19, y IQ Server versiones anteriores a 72, presenta una ejecución de código remota. • https://issues.sonatype.org/secure/ReleaseNote.jspa https://support.sonatype.com/hc/en-us/articles/360036132453 • CWE-434: Unrestricted Upload of File with Dangerous Type •