Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2862▼ 326 respecto a la semana anterior
Críticas / altas1389▼ 28 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)293▼ 216 respecto a la semana anterior
88 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Analizada | Media (4.9) | 0.98% | — | Sonatype Nexus Repository Manager | 23/4/2021 | 22/9/2026 | Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. | |
| Modificada | Media (6.5) | 1.5% | — | Sonatype Nexus Repository Manager | 17/12/2020 | 17/6/2026 | Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0. | |
| Modificada | Alta (8.6) | 2.6% | — | Sonatype Nexus Repository Manager | 12/10/2020 | 17/6/2026 | A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to). | |
| Modificada | Alta (7.5) | 1.1% | — | Sonatype Nexus Repository Manager | 12/8/2020 | 17/6/2026 | Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control. | |
| Analizada | Alta (8.8) | 2.2% | — | Sonatype Nexus Repository Manager | 31/7/2020 | 22/9/2026 | Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution. | |
| Analizada | Media (6.1) | 0.68% | — | Sonatype Nexus Repository Manager | 31/7/2020 | 22/9/2026 | Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). | |
| Analizada | Media (5.4) | 0.68% | — | Sonatype Nexus Repository Manager | 31/7/2020 | 22/9/2026 | Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). | |
| Modificada | Media (4.9) | 0.65% | — | Sonatype Nexus Repository Manager | 27/4/2020 | 17/6/2026 | An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext. | |
| Analizada | Alta (8.8) | 1.7% | — | Sonatype Nexus Repository Manager | 20/4/2020 | 22/9/2026 | An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable). | |
| Modificada | Alta (7.2) | 5.6% | 💥 PoC | Sonatype Nexus Repository Manager | 1/11/2019 | 17/6/2026 | There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability. | |
| Modificada | Alta (7.2) | 3.3% | — | Sonatype Nexus IQ ServerSonatype Nexus Repository Manager | 21/10/2019 | 17/6/2026 | Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution. | |
| Modificada | Alta (7.2) | 2.1% | — | Sonatype Nexus Repository Manager | 16/10/2019 | 17/6/2026 | Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution. | |
| Modificada | Alta (8.8) | 18% | 💥 PoC | Sonatype Nexus Repository Manager | 3/9/2019 | 17/6/2026 | The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability. | |
| Modificada | Media (5.4) | 1.1% | — | Sonatype Nexus Repository Manager | 22/8/2019 | 17/6/2026 | In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS. | |
| Modificada | Alta (7.5) | 1.4% | — | Sonatype Nexus Repository Manager | 8/7/2019 | 17/6/2026 | Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images. | |
| Modificada | Crítica (9.8) | 1.5% | — | Sonatype Nexus Repository Manager | 8/7/2019 | 17/6/2026 | Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials). | |
| Modificada | Media (6.1) | 0.74% | — | Sonatype Nexus Repository Manager | 7/5/2019 | 17/6/2026 | Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS. | |
| Analizada | Crítica (9.8) | 77% | ⚠ Explotación activa💥 Exploit | Sonatype Nexus Repository Manager | 21/3/2019 | 17/6/2026 | Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. | |
| Modificada | Alta (7.2) | 5.2% | 💥 PoC | Sonatype Nexus Repository Manager | 15/11/2018 | 17/6/2026 | Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection. | |
| Modificada | Alta (7.5) | 1.1% | — | Sonatype Nexus Repository Manager | 15/11/2018 | 17/6/2026 | Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control. | |
| Modificada | Media (6.1) | 0.69% | — | Sonatype Nexus Repository Manager | 15/11/2018 | 17/6/2026 | Sonatype Nexus Repository Manager before 3.14 allows XSS. | |
| Modificada | Media (4.8) | 1.3% | — | Sonatype Nexus Repository Manager | 11/6/2018 | 17/6/2026 | Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI. | |
| Modificada | Media (6.5) | 2.3% | — | HP Version Control Repository Manager | 15/2/2018 | 17/6/2026 | A remote denial of service vulnerability in HPE Version Control Repository Manager (VCRM) in all versions prior to 7.6 was found. | |
| Modificada | Alta (8.8) | 1.9% | — | HP Version Control Repository Manager | 15/2/2018 | 17/6/2026 | A remote malicious file upload vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. | |
| Modificada | Media (6.5) | 1.7% | — | HP Version Control Repository Manager | 15/2/2018 | 17/6/2026 | A remote information disclosure in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. |