GR
Product
gradle
23
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 13Medium 7Low 0
Watch
Add gradle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-26053 | 9.8 | Mar 2 | Gradle is a build tool with a focus on build automation and support for multi-language development Affected: 6.2.0 before 6.9.4; 7.0.0 before 7.6.1 |
| CVE-2019-15052 | 9.8 | Aug 14 | The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host Affected: before 5.6 |
| CVE-2016-6199 | 9.8 | Feb 7 | ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object Affected: 2.12 |
| CVE-2023-35947 | 8.1 | Jun 30 | Gradle is a build tool with a focus on build automation and support for multi-language development Affected: before 7.6.2; 8.0.0 before 8.2.0 |
| CVE-2021-41588 | 8.1 | Sep 24 | In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects Affected: 2017.2 before 2021.1.3 |
| CVE-2021-29428 | 7.8 | Apr 13 | Local privilege escalation through system temporary directory Affected: < 7.0 |
| CVE-2022-23630 | 7.5 | Feb 10 | Gradle is a build tool with a focus on build automation and support for multi-language development Affected: 6.2.0 through 7.3.3 |
| CVE-2021-41587 | 7.5 | Sep 24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources Affected: 2017.6 before 2021.1.3 |
| CVE-2021-41586 | 7.5 | Sep 24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password Affected: 2020.4 before 2021.1.3 |
| CVE-2021-41584 | 7.5 | Sep 24 | Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP… Affected: 2020.4 before 2021.1.3 |
| CVE-2021-32751 | 7.5 | Jul 20 | Arbitrary code execution via specially crafted environment variables Affected: < 7.2 |
| CVE-2020-11979 | 7.5 | Oct 1 | As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them Affected: before 6.8.0 |
| CVE-2026-22865 | 7.4 | Jan 16 | Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts Affected: < 9.3.0 |
| CVE-2026-22816 | 7.4 | Jan 16 | Gradle fails to disable repositories which can expose builds to malicious artifacts Affected: < 9.3.0 |
| CVE-2022-30586 | 7.2 | Jun 6 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution Affected: before 1.3.1 |
| CVE-2021-29427 | 7.2 | Apr 13 | In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning Affected: 5.1 before 7.0 |
| CVE-2023-44387 | 6.5 | Oct 5 | Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations Affected: >= 7.6.0, < 7.6.3; < 8.4.0 |
| CVE-2019-16370 | 5.9 | Sep 16 | The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1… Affected: before 6.0 |
| CVE-2019-11065 | 5.9 | Apr 10 | Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used Affected: 1.4 through 5.3.1 |
| CVE-2023-35946 | 5.5 | Jun 30 | Dependency cache path traversal in Gradle Affected: < 7.6.2; >= 8.0, < 8.2 |
| CVE-2021-29429 | 5.5 | Apr 12 | Information disclosure through temporary directory permissions Affected: < 7.0 |
| CVE-2023-42445 | 5.3 | Oct 6 | Gradle is a build tool with a focus on build automation and support for multi-language development Affected: before 7.6.3; 8.0.0 before 8.4.0 |
| CVE-2022-31156 | 4.4 | Jul 14 | Gradle is a build tool Affected: 6.2.0 before 7.5.0 |
Showing 23