Advisories · Technology
jfrog artifactory.
Every CVE that names jfrog artifactory among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Potential authentication bypass leading to administrative access in Artifactory
- jfrog artifactory
- Authentication bypass
- CVSS 6.5 Medium
Potential unauthorized access to private Composer repository metadata in JFrog Artifactory
- jfrog artifactory
- Broken access control
- CVSS 3.5 Low
SSRF In CocoaPods Via JFrog Artifactory External Dependency
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Potential unauthorized repository migration in JFrog Artifactory
- jfrog artifactory
- Broken access control
- CVSS 8.5 High
Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Potential cache poisoning in JFrog Artifactory
- jfrog artifactory
- CWE-20
- CVSS 7.5 HighCritical · KEVKEV
Anonymous user token generation exposure in JFrog Artifactory
- jfrog artifactory
- Authentication bypass
- CVSS 5.9 Medium
Potential unauthorized artifact access in JFrog Artifactory
- jfrog artifactory
- Broken access control
- CVSS 8.1 High
Potential package cache integrity issue in JFrog Artifactory
- jfrog artifactory
- CWE-345
- CVSS 4.3 Medium
Potential unauthorized metadata exposure in JFrog Artifactory
- jfrog artifactory
- Broken access control
- CVSS 6.7 Medium
Rendered Artifactory Helm manifests may contain generated TLS private keys
- jfrog artifactory
- Information disclosure
- CVSS 7.2 High
Integration credential holders may impersonate users in JFrog Access
- jfrog artifactory
- Weak cryptography or TLS
- CVSS 3.1 Low
Private Release Bundle versions may be disclosed under specific configurations
- jfrog artifactory
- Broken access control
- CVSS 5.3 MediumCritical · KEVKEV
Authenticated users may write data outside the intended Docker cache path
- jfrog artifactory
- Path traversal
- CVSS 6.5 Medium
Authenticated users may access restricted Artifactory support information
- jfrog artifactory
- Broken access control
- CVSS 8.1 High
Low-privilege users may remove protected Artifactory metadata
- jfrog artifactory
- Broken access control
- CVSS 7.5 High
Potential improper SAML signature verification in JFrog Artifactory
- jfrog artifactory
- Weak cryptography or TLS
- CVSS 6.6 Medium
Potential insecure deserialization in JFrog Artifactory
- jfrog artifactory
- Insecure deserialization
- CVSS 4.3 Medium
Authenticated users may write files outside the intended Artifactory work directory
- jfrog artifactory
- Path traversal
- CVSS 5.3 Medium
Repository readers may access content outside configured upstream paths
- jfrog artifactory
- Path traversal
- CVSS 5.3 Medium
Potential remember-me authentication bypass in JFrog Artifactory
- jfrog artifactory
- Authentication bypass
- CVSS 4.3 Medium
Authenticated users may view private Puppet module metadata
- jfrog artifactory
- Broken access control
- CVSS 4.3 Medium
Authenticated users may access private NuGet metadata
- jfrog artifactory
- Broken access control
- CVSS 5.3 Medium
Anonymous users may access restricted Artifactory repository information
- jfrog artifactory
- Broken access control
- CVSS 4.3 Medium
Bundle writers may alter trusted release information in JFrog Artifactory
- jfrog artifactory
- Broken access control
- CVSS 4.3 Medium
Authenticated users may access private OCI referrer metadata
- jfrog artifactory
- Broken access control
- CVSS 6.5 Medium
Publishers without delete permission can overwrite docker layer information
- jfrog artifactory
- Broken access control
- CVSS 5.3 Medium
Anonymous users may access restricted Artifactory content under specific configurations
- jfrog artifactory
- Broken access control
- CVSS 4.2 Medium
Deleted users may temporarily retain access to JFrog Artifactory
- jfrog artifactory
- Authentication bypass
- CVSS 7.2 High
Project Resource Managers may escalate privileges in JFrog Artifactory
- jfrog artifactory
- Privilege escalation
- CVSS 7.1 High
Potential unauthorized modification of Artifactory internal metadata
- jfrog artifactory
- Broken access control
- CVSS 6.8 Medium
Potential server-side request forgery in Artifactory Ansible repository handling
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Potential remote code execution on an Artifactory package service container.
- jfrog artifactory
- Insecure deserialization
- CVSS 6.5 Medium
Server-Side Request Forgery (SSRF) via Terraform Remote repository
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Potential privilege escalation to JFrog administrator privileges
- jfrog artifactory
- Weak cryptography or TLS
- CVSS 7.2 High
JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.
- jfrog artifactory
- Privilege escalation
- CVSS 6.5 Medium
Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
JFrog Artifactory build environment properties exposure
- jfrog artifactory
- Information disclosure
- CVSS 8.8 High
Potential authentication bypass leading to privilege escalation in Artifactory
- jfrog artifactory
- Authentication bypass
- CVSS 8.8 High
Potential path traversal leading to unauthorized file writes
- jfrog artifactory
- Path traversal
- CVSS 8.8 High
Privilege escalation via JFrog Worker event token exposure
- jfrog artifactory
- Information disclosure
- CVSS 8.1 HighCritical · KEVKEV
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
- jfrog artifactory
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
JFrog Artifactory Cache Poisoning
- JFrog Artifactory
- CWE-20
- CVSS 6.4 Medium
JFrog Artifactory Header Injection
- JFrog Artifactory
- CWE-20
- CVSS 9.0 CriticalCritical · CVSS 9+
JFrog Artifactory Improper input validation within token creation flow
- JFrog Artifactory
- CWE-20
- CVSS 8.8 High
JFrog Artifactory Cross-Site Scripting
- JFrog Artifactory
- Cross-site scripting (XSS)
- CVSS 6.6 Medium
JFrog Artifactory Sensitive Data Leakage in Repository configuration process
- JFrog Artifactory
- CWE-755
- CVSS 7.2 High
JFrog Artifactory Improper input validation leads to arbitrary file write
- JFrog Artifactory
- CWE-20
- CVSS 9.3 CriticalCritical · CVSS 9+
JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens
- JFrog Artifactory
- Authentication bypass
- CVSS 6.5 Medium
JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform
- JFrog Artifactory
- CWE-20
- CVSS 5.3 Medium
JFrog Artifactory: JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass…
- JFrog Artifactory
- CWE-274
- CVSS 3.1 Low
Cross-site request forgery in JFrog Artifactory
- JFrog Artifactory
- Cross-site request forgery (CSRF)
- CVSS 4.9 Medium
Exposure of personal information in JFrog Artifactory
- JFrog Artifactory
- Information disclosure
- CVSS 6.1 Medium
Cross-site scripting in JFrog Artifactory
- JFrog Artifactory
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Improper access control in JFrog Artifactory
- JFrog Artifactory
- Broken access control
- CVSS 6.0 Medium
Improper access control in JFrog Artifactory
- JFrog Artifactory
- Broken access control
- CVSS 8.8 High
Deserialization of untrusted data in JFrog Artifactory
- JFrog Artifactory
- Insecure deserialization
- CVSS 2.7 Low
Improper access control in JFrog Artifactory
- JFrog Artifactory
- Broken access control
- CVSS 4.3 Medium
Improper access control in JFrog Artifactory
- JFrog Artifactory
- Broken access control