Sonatype

sonatype

45 CVEs • 4 products

Products (4)

Click to collapse

Toggle

Nexus Repository Manager

nexus_repository_manager

Nexus Repository Manager 3

nexus_repository_manager_3

Nexus Iq Server

nexus_iq_server

CVEs (45)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-5306 1Sonatype 1Nexus Repository Manager Nov 21, 2024 Feb 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter...Show more Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.Show less
CVE-2017-17717 1Sonatype 1Nexus Repository Manager May 13, 2026 Dec 17, 2017 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.
CVE-2014-9389 1Sonatype 1Nexus May 6, 2026 Jan 5, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors.
CVE-2014-2034 1Sonatype 1Nexus May 6, 2026 Apr 1, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path."
CVE-2014-0792 1Sonatype 1Nexus Apr 29, 2026 Jan 17, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.