Jfrog
jfrog
70 CVEs • 1 product
Products (1)
Click to collapseToggle
Products (1)
Click to collapse
CVEs (70)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
An authenticated user may view private Puppet module metadata without repository read access. |
An authenticated user without repository read permission may access private NuGet metadata under specific conditions. |
An unauthenticated user may access restricted repository information under specific conditions. |
Credentials for a deleted user may remain valid for a short period under specific conditions. |
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions. |
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected...Show more |
An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access. |
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level. |
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. |
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthentica...Show more |
A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidenti...Show more |
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is li...Show more |
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location. |
Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data. |
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions. |
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. |
An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions. |
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. |
JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deplo...Show more |
JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. |