Export limit exceeded: 408903 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (83 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-0600 | 1 Sonatype | 1 Nexus Repository Manager | 2026-04-18 | N/A |
| Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default. | ||||
| CVE-2024-4956 | 1 Sonatype | 1 Nexus Repository Manager | 2026-04-15 | 7.5 High |
| Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1. | ||||
| CVE-2024-5082 | 1 Sonatype | 1 Nexus Repository Manager | 2026-04-15 | N/A |
| A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1. | ||||
| CVE-2024-5083 | 1 Sonatype | 1 Nexus Repository Manager | 2026-04-15 | N/A |
| A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1. | ||||
| CVE-2025-13488 | 1 Sonatype | 1 Nexus Repository Manager | 2026-04-15 | N/A |
| Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context. | ||||
| CVE-2025-9868 | 1 Sonatype | 1 Nexus Repository Manager | 2026-04-15 | N/A |
| Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests. | ||||
| CVE-2020-10199 | 1 Sonatype | 1 Nexus | 2025-11-07 | 8.8 High |
| Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). | ||||
| CVE-2019-7238 | 1 Sonatype | 1 Nexus Repository Manager | 2025-11-06 | 9.8 Critical |
| Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. | ||||
| CVE-2024-5764 | 1 Sonatype | 1 Nexus Repository Manager | 2025-11-06 | 6.5 Medium |
| Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others). The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an alternate encryption passphrase, it could only be done at first boot and not updated. This issue affects Nexus Repository: from 3.0.0 through 3.72.0. | ||||
| CVE-2017-17717 | 1 Sonatype | 1 Nexus Repository Manager | 2025-04-20 | N/A |
| Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. | ||||
| CVE-2014-9389 | 1 Sonatype | 1 Nexus | 2025-04-12 | N/A |
| Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors. | ||||
| CVE-2014-2034 | 1 Sonatype | 1 Nexus | 2025-04-12 | N/A |
| Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path." | ||||
| CVE-2014-0792 | 1 Sonatype | 1 Nexus | 2025-04-11 | N/A |
| Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types. | ||||
| CVE-2022-27907 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.3 Medium |
| Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. | ||||
| CVE-2021-43961 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.3 Medium |
| Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection. | ||||
| CVE-2021-43293 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.3 Medium |
| Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF). | ||||
| CVE-2021-42568 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.3 Medium |
| Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account. | ||||
| CVE-2021-37152 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 5.4 Medium |
| Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications. | ||||
| CVE-2021-34553 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 4.3 Medium |
| Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access. | ||||
| CVE-2021-30635 | 1 Sonatype | 1 Nexus Repository Manager | 2024-11-21 | 5.3 Medium |
| Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed). | ||||