CVSS: 9.1EPSS: 45%CPEs: 5EXPL: 2CVE-2021-26291 – block repositories using http by default
https://notcve.org/view.php?id=CVE-2021-26291
23 Apr 2021 — Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to... • https://github.com/jpmartins/MinimalReproducer • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-346: Origin Validation Error •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26719
https://notcve.org/view.php?id=CVE-2021-26719
09 Feb 2021 — A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations. Se detectó un problema de salto de directorio en Gradle gradle-enterprise-test-distribution-agent versiones anteriores a 1.3.2, test... • https://security.gradle.com/advisory/CVE-2021-26719 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10358
https://notcve.org/view.php?id=CVE-2019-10358
31 Jul 2019 — Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log. El Plugin Maven Integration de Jenkins versión 3.3 y anteriores, no aplicaban decoradores de registro de compilación a las compilaciones de módulos, lo que potencialmente revelaba variables de compilación confidenciales en el registro de compilación. • http://www.openwall.com/lists/oss-security/2019/07/31/1 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-9843
https://notcve.org/view.php?id=CVE-2019-9843
15 Mar 2019 — In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file. En DiffPlug Spotless en versiones anteriores a 1.20.0 (library and Maven plugin) y anteriores a 3.20.0 (Gradle plugin), el analizador XML reso... • https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000397
https://notcve.org/view.php?id=CVE-2017-1000397
26 Jan 2018 — Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient. El plugin Jenkins Maven 2.73.1 y anteriores y 2.17 y anteriores incluía una versión de la biblioteca commons-httpclient con la vulnerabilidad CVE-2012-6153 que verificaba incorrectamente los certificados SSL, volviéndolo s... • https://jenkins.io/security/advisory/2017-10-11 • CWE-20: Improper Input Validation •