← Back

Sonatype

sonatype

72 CVEs • 4 products

Products (4)

Click to collapse
Toggle
Nexus Repository Manager
nexus_repository_manager
64 CVEs
Nexus
nexus
8 CVEs
Nexus Repository Manager 3
nexus_repository_manager_3
6 CVEs
Nexus Iq Server
nexus_iq_server
1 CVE

CVEs (72)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-29436
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Dec 17, 2020
N/A· v4
6.5 MEDIUM· v3
5.5 MEDIUM· v2
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.
CVE-2020-15012
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Oct 12, 2020
N/A· v4
8.6 HIGH· v3
7.8 HIGH· v2
A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user runn...Show more
A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to).Show less
CVE-2020-24622
1Sonatype
1Nexus
Jun 17, 2026
Aug 25, 2020
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.
CVE-2020-15868
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Aug 12, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.
CVE-2020-15871
1Sonatype
2Nexus Repository Manager
Nexus Repository Manager 3
Sep 22, 2026
Jul 31, 2020
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.
CVE-2020-15870
1Sonatype
2Nexus Repository Manager
Nexus Repository Manager 3
Sep 22, 2026
Jul 31, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).
CVE-2020-15869
1Sonatype
2Nexus Repository Manager
Nexus Repository Manager 3
Sep 22, 2026
Jul 31, 2020
N/A· v4
5.4 MEDIUM· v3
4.3 MEDIUM· v2
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).
CVE-2020-11415
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Apr 27, 2020
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.
CVE-2020-11753
1Sonatype
2Nexus Repository Manager
Nexus Repository Manager 3
Sep 22, 2026
Apr 20, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or AP...Show more
An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).Show less
CVE-2020-11444
1Sonatype
1Nexus
Jun 17, 2026
Apr 2, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
CVE-2020-10204
1Sonatype
1Nexus
Jun 17, 2026
Apr 1, 2020
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
CVE-2020-10203
1Sonatype
1Nexus
Jun 17, 2026
Apr 1, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Sonatype Nexus Repository before 3.21.2 allows XSS.
CVE-2020-10199
1Sonatype
1Nexus
Jun 17, 2026
Apr 1, 2020
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
CVE-2019-15588
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Nov 1, 2019
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied d...Show more
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.Show less
CVE-2019-16530
1Sonatype
2Nexus Iq Server
Nexus Repository Manager
Jun 17, 2026
Oct 21, 2019
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
CVE-2019-15893
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Oct 16, 2019
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.
CVE-2019-5475
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Sep 3, 2019
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.
CVE-2019-14469
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Aug 22, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.
CVE-2019-9630
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Jul 8, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.
CVE-2019-9629
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Jul 8, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).