Jfrog Artifactory
35 CVEs affecting Jfrog Artifactory. Latest disclosed: 2024-08-05. Critical: 8, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17444 | Critical | 9.8 | 2020-10-12 | Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorize… |
CVE-2018-19971 | Critical | 9.8 | 2019-04-16 | JFrog Artifactory Pro 6.5.9 has Incorrect Access Control. |
CVE-2019-9733 | Critical | 9.8 | 2019-04-11 | An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administ… |
CVE-2016-10036 | Critical | 9.8 | 2018-05-01 | Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet applic… |
CVE-2016-6501 | Critical | 9.8 | 2016-12-09 | JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poi… |
CVE-2024-6915 | Critical | 9.3 | 2024-08-05 | JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could p… |
CVE-2023-42662 | Critical | 9.3 | 2024-03-07 | JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially craft… |
CVE-2024-4142 | Critical | 9.0 | 2024-05-01 | An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability… |
CVE-2024-2247 | High | 8.8 | 2024-03-13 | JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. |
CVE-2022-0573 | High | 8.8 | 2022-05-16 | JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote… |
CVE-2021-3860 | High | 8.8 | 2021-12-20 | JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete v… |
CVE-2020-7931 | High | 8.8 | 2020-01-23 | In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patch… |
CVE-2018-1000206 | High | 8.8 | 2018-07-13 | JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allo… |
CVE-2018-1000424 | High | 7.8 | 2019-01-09 | An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.jav… |
CVE-2020-2165 | High | 7.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulti… |
CVE-2023-42661 | High | 7.2 | 2024-03-07 | JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specia… |
CVE-2019-19937 | High | 7.2 | 2020-03-16 | In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "un… |
CVE-2018-1000623 | High | 7.2 | 2018-07-09 | JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" fe… |
CVE-2023-42509 | Medium | 6.6 | 2024-03-07 | JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in reposi… |
CVE-2023-42508 | Medium | 6.5 | 2023-10-03 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users be… |