Vulnerabilities > Sonatype > Nexus Repository Manager

DATE CVE VULNERABILITY TITLE RISK
2018-11-15 CVE-2018-16621 Expression Language Injection vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
network
low complexity
sonatype CWE-917
6.5
2018-11-15 CVE-2018-16620 Incorrect Authorization vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.
network
low complexity
sonatype CWE-863
5.0
2018-11-15 CVE-2018-16619 Cross-site Scripting vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager before 3.14 allows XSS.
network
sonatype CWE-79
4.3
2018-06-11 CVE-2018-12100 Cross-site Scripting vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.
network
sonatype CWE-79
3.5
2018-02-09 CVE-2018-5307 Cross-site Scripting vulnerability in Sonatype Nexus Repository Manager
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.
network
sonatype CWE-79
4.3
2018-02-09 CVE-2018-5306 Cross-site Scripting vulnerability in Sonatype Nexus Repository Manager
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.
network
sonatype CWE-79
4.3
2017-12-17 CVE-2017-17717 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.
network
low complexity
sonatype CWE-327
critical
10.0