Potential authentication bypass leading to administrative access in Artifactory

Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

Anonymous user token generation exposure in JFrog Artifactory

Authenticated users may write data outside the intended Docker cache path

JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated…

Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them

JFrog Artifactory Pro 6.5.9 has Incorrect Access Control

An issue was discovered in JFrog Artifactory 6.7.3

Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet application and execute…

JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning

Potential cache poisoning in JFrog Artifactory

Potential remote code execution on an Artifactory package service container.

Potential privilege escalation to JFrog administrator privileges

Potential authentication bypass leading to privilege escalation in Artifactory

Potential path traversal leading to unauthorized file writes

Privilege escalation via JFrog Worker event token exposure

JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series…

JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints

JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when…

JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when…

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to…

Server-Side Request Forgery Via VCS remote download in JFrog Artifactory

Potential package cache integrity issue in JFrog Artifactory

Low-privilege users may remove protected Artifactory metadata

An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows…

Potential unauthorized repository migration in JFrog Artifactory

Potential improper SAML signature verification in JFrog Artifactory

JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration…

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure

Integration credential holders may impersonate users in JFrog Access

Project Resource Managers may escalate privileges in JFrog Artifactory

JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.

In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."

JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available…

Potential server-side request forgery in Artifactory Ansible repository handling

Rendered Artifactory Helm manifests may contain generated TLS private keys

Potential insecure deserialization in JFrog Artifactory

Potential unauthorized access to private Composer repository metadata in JFrog Artifactory

Authenticated users may access restricted Artifactory support information

Publishers without delete permission can overwrite docker layer information

Server-Side Request Forgery (SSRF) via Terraform Remote repository

Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability

JFrog Artifactory build environment properties exposure

JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead…

JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send…

JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any…

Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by…

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging,…