Vulnerabilities > Jfrog > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-10-03 | CVE-2023-42508 | Unspecified vulnerability in Jfrog Artifactory JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body. | 6.5 |
| 2022-07-06 | CVE-2021-45721 | Cross-site Scripting vulnerability in Jfrog Artifactory JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. | 6.1 |
| 2022-07-06 | CVE-2021-46687 | Exposure of Resource to Wrong Sphere vulnerability in Jfrog Artifactory JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. | 4.9 |
| 2022-05-23 | CVE-2021-41834 | Unspecified vulnerability in Jfrog Artifactory JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation. | 6.5 |
| 2022-05-19 | CVE-2021-45730 | Unspecified vulnerability in Jfrog Artifactory JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators. | 4.9 |
| 2022-03-02 | CVE-2021-45074 | Unspecified vulnerability in Jfrog Artifactory JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session. | 5.4 |
| 2020-03-25 | CVE-2020-2164 | Insufficiently Protected Credentials vulnerability in Jfrog Artifactory Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system. | 6.5 |
| 2019-05-31 | CVE-2019-10324 | Cross-Site Request Forgery (CSRF) vulnerability in Jfrog Artifactory A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively. | 6.5 |
| 2019-05-31 | CVE-2019-10323 | Missing Authorization vulnerability in Jfrog Artifactory A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. | 4.3 |
| 2019-05-31 | CVE-2019-10322 | Missing Authorization vulnerability in Jfrog Artifactory A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | 4.3 |