Central Security Project Program Statistics

View program

8 total issues disclosed

$0 total paid publicly

Most disclosed (2 disclosures) — XML Entity Expansion

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
Repositories of datanucleus are fetched over insecure protocol (http insted of https) Man-in-the-Middle keval_j High 2020-10-05
Unsafe deserialization in Nexus Repository helm plugin Deserialization of Untrusted Data c0d3p1ut0s Critical 2020-09-11
OS Command Injection in Nexus Repository Manager 2.x -- Bypass for Nexus Repository Manage 2.14.15-01 Command Injection fix Command Injection - Generic longofo Critical 2020-06-29
Unrestricted File Upload Leading to Remote Code Execution Business Logic Errors hland Critical 2019-10-30
OS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475) Command Injection - Generic badcode_ Critical 2019-10-29
OS Command Injection in Nexus Repository Manager 2.x OS Command Injection christianaugust Critical 2019-08-20
Pippo XML Entity Expansion (Billion Laughs Attack) XML Entity Expansion amassey High 2019-06-10
c3p0 may be exploited by a Billion Laughs Attack when loading XML configuration XML Entity Expansion amassey Medium 2019-04-16