Advisories · Technology
Sonatype Nexus Repository 3.
Every CVE that names Sonatype Nexus Repository 3 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Nexus Repository 3 - Group Repository Member Authorization Bypass
- Sonatype Nexus Repository 3
- Broken access control
- CVSS 6.3 Medium
Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab
- Sonatype Nexus Repository 3
- Cross-site scripting (XSS)
- CVSS 7.7 High
Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task
- Sonatype Nexus Repository 3
- SQL injection
- CVSS 7.1 High
Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase
- Sonatype Nexus Repository 3
- Hard-coded credentials
- CVSS 7.1 High
Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key
- Sonatype Nexus Repository 3
- Hard-coded credentials
- CVSS 9.1 CriticalCritical · CVSS 9+
Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again
- Sonatype Nexus Repository 3
- Authentication bypass
- CVSS 8.6 High
Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation
- Sonatype Nexus Repository 3
- Broken access control
- CVSS 8.7 High
Nexus Repository 3 - Privilege Escalation via Role Management
- Sonatype Nexus Repository 3
- Broken access control
- CVSS 5.1 Medium
Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
- Sonatype Nexus Repository 3
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
- Sonatype Nexus Repository 3
- Code injection
- CVSS 7.1 High
Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload
- Sonatype Nexus Repository 3
- Broken access control
- CVSS 5.3 Medium
Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields
- Sonatype Nexus Repository 3
- Denial of service
- CVSS 5.3 Medium
Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions
- Sonatype Nexus Repository 3
- Broken access control
- CVSS 6.0 Medium
Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API
- Sonatype Nexus Repository 3
- Information disclosure
- CVSS 7.5 High
Nexus Repository 3 - Script Execution Disable Setting Not Enforced
- Sonatype Nexus Repository 3
- CWE-184
- CVSS 7.1 High
Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints
- Sonatype Nexus Repository 3
- Broken access control
- CVSS 8.6 High
Nexus Repository 3 - Privilege Escalation
- Sonatype Nexus Repository 3
- Memory corruption
- CVSS 8.2 High
Nexus Repository 3 - Authorization Bypass in Repository Creation
- Sonatype Nexus Repository 3
- Broken access control
- CVSS 5.3 Medium
Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass
- Sonatype Nexus Repository 3
- Information disclosure
- CVSS 6.3 Medium
Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name
- Sonatype Nexus Repository 3
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration
- Sonatype Nexus Repository 3
- Broken access control
- CVSS 6.9 Medium
Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint
- Sonatype Nexus Repository 3
- CWE-620
- CVSS 8.7 High
Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation
- Sonatype Nexus Repository 3
- Sonatype
- Authentication bypass
- CVSS 8.9 High
Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator
- Sonatype Nexus Repository 3
- Broken access control
- CVSS 8.7 High
Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API
- Sonatype Nexus Repository 3
- Code injection
- CVSS 5.1 Medium
Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification
- Sonatype Nexus Repository 3
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect
- Sonatype Nexus Repository 3
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability
- Sonatype Nexus Repository 3
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Nexus Repository 3 - Authorization Bypass in Component Upload API
- Sonatype Nexus Repository 3
- Broken access control