Vendor
jfrog
65 known vulnerabilities.
Products
34 results · Clear filters · Feed
-
Medium 6.5
Potential unauthorized access to private Composer repository metadata in JFrog Artifactory
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been …
-
Medium 5.9
Potential unauthorized artifact access in JFrog Artifactory
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
-
Medium 4.3
Potential unauthorized metadata exposure in JFrog Artifactory
An authenticated user without repository read permission may access package metadata under specific conditions.
-
Medium 6.7
Rendered Artifactory Helm manifests may contain generated TLS private keys
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
-
Medium 5.3
Authenticated users may write data outside the intended Docker cache path
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
KEV Aug 27, 2026 -
Medium 6.5
Authenticated users may access restricted Artifactory support information
A low-privileged authenticated user may access restricted support information under specific conditions.
-
Medium 6.6
Potential insecure deserialization in JFrog Artifactory
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
-
Medium 4.3
Authenticated users may write files outside the intended Artifactory work directory
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
-
Medium 5.3
Repository readers may access content outside configured upstream paths
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
-
Medium 5.3
Potential remember-me authentication bypass in JFrog Artifactory
An unauthenticated user may bypass authentication under specific cache conditions.
-
Medium 4.3
Authenticated users may view private Puppet module metadata
An authenticated user may view private Puppet module metadata without repository read access.
-
Medium 4.3
Authenticated users may access private NuGet metadata
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
-
Medium 5.3
Anonymous users may access restricted Artifactory repository information
An unauthenticated user may access restricted repository information under specific conditions.
-
Medium 4.3
Bundle writers may alter trusted release information in JFrog Artifactory
A bundle writer may create misleading release promotion information under specific conditions.
-
Medium 4.3
Authenticated users may access private OCI referrer metadata
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
-
Medium 6.5
Publishers without delete permission can overwrite docker layer information
A repository publisher without delete permission may modify protected package content under specific conditions.
-
Medium 5.3
Anonymous users may access restricted Artifactory content under specific configurations
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
-
Medium 4.2
Deleted users may temporarily retain access to JFrog Artifactory
Credentials for a deleted user may remain valid for a short period under specific conditions.
-
Medium 6.8
Potential server-side request forgery in Artifactory Ansible repository handling
A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addres…
-
Medium 6.5
Server-Side Request Forgery (SSRF) via Terraform Remote repository
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to i…
-
Medium 6.5
Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.
-
Medium 6.5
Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability
Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.
-
Medium 6.5
JFrog Artifactory build environment properties exposure
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secr…
-
Medium 4.9
JFrog Artifactory Cross-Site Scripting
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scripting (XSS).This issue affects Artifactory (Workers): from >=7.94.0 through <7.117.10.
-
Medium 6.4
JFrog Artifactory Header Injection
A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email.
-
Medium 4.3
JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users
JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments.
-
Medium 6.6
JFrog Artifactory Sensitive Data Leakage in Repository configuration process
JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.
-
Medium 6.5
JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform
JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.
-
Medium 5.3
JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when …
-
Medium 4.9
JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Adm…
-
Medium 6.1
JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one…
-
Medium 5.3
JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality c…
-
Medium 6.0
JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edi…
-
Medium 4.3
JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to d…