Subscribe to the RSS Feed | 

JFrog takes the privacy and security of its customers very seriously and always strives to provide prompt notification and remediation of any vulnerabilities discovered on JFrog products. As a CVE Numbering Authority (CNA), JFrog assigns CVE identification numbers to newly discovered security vulnerabilities.

Severity	CVE	Summary	Product	Versions	Published	Updated
	CVE-2021-3860	JFrog Artifactory prior to version 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL  Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.	Artifactory	Versions prior to 7.25.4 Versions prior to 6.23.30	12/15/2021	12/15/2021
	CVE-2021-45074	JFrog Artifactory prior to7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session.	Artifactory	Versions prior to 7.29.3 Versions prior to 6.23.38	03/02/2022	03/02/2022
	CVE-2021-46270	JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insufficient permission validation.	Artifactory	Versions prior to 7.31.10	03/02/2022	03/02/2022
	CVE-2022-0573	JFrog Artifactory prior to 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation, and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.	Artifactory	Versions prior to 7.36.1 Versions prior to 6.34.41	12/5/2022