Vulnerabilities > Sonatype > Nexus Repository Manager > Medium

DATE CVE VULNERABILITY TITLE RISK
2019-10-16 CVE-2019-15893 Unspecified vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.
network
low complexity
sonatype
6.5
2019-07-08 CVE-2019-9630 Incorrect Default Permissions vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.
network
low complexity
sonatype CWE-276
5.0
2019-05-07 CVE-2019-11629 Cross-site Scripting vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.
network
sonatype CWE-79
4.3
2018-11-15 CVE-2018-16621 Expression Language Injection vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
network
low complexity
sonatype CWE-917
6.5
2018-11-15 CVE-2018-16620 Incorrect Authorization vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.
network
low complexity
sonatype CWE-863
5.0
2018-11-15 CVE-2018-16619 Cross-site Scripting vulnerability in Sonatype Nexus Repository Manager
Sonatype Nexus Repository Manager before 3.14 allows XSS.
network
sonatype CWE-79
4.3
2018-02-09 CVE-2018-5307 Cross-site Scripting vulnerability in Sonatype Nexus Repository Manager
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.
network
sonatype CWE-79
4.3
2018-02-09 CVE-2018-5306 Cross-site Scripting vulnerability in Sonatype Nexus Repository Manager
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.
network
sonatype CWE-79
4.3