Apache Netbeans
By the Year
In 2023 there have been 0 vulnerabilities in Apache Netbeans . Netbeans did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 3 | 8.80 |
| 2019 | 0 | 0.00 |
| 2018 | 1 | 9.80 |
It may take a day or so for new Netbeans vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Netbeans Security Vulnerabilities
To be able to analyze gradle projects, the build scripts need to be executed
CVE-2020-11986
9.8 - Critical
- September 09, 2020
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads
CVE-2019-17560
9.1 - Critical
- March 30, 2020
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
Improper Certificate Validation
The "Apache NetBeans" autoupdate system does not fully validate code signatures
CVE-2019-17561
7.5 - High
- March 30, 2020
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
Improper Verification of Cryptographic Signature
Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE)
CVE-2018-17191
9.8 - Critical
- December 31, 2018
Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn script engine the environment of the javascript execution for the Proxy Auto-Configuration leaks privileged objects, that can be used to circumvent the execution limits. If a different script engine was used, no execution limits were in place. Both vectors allow remote code execution.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Netbeans or by Apache? Click the Watch button to subscribe.
