Netbeans Apache Netbeans

Do you want an email whenever new security vulnerabilities are reported in Apache Netbeans?

By the Year

In 2024 there have been 0 vulnerabilities in Apache Netbeans . Netbeans did not have any published security vulnerabilities last year.

Year Vulnerabilities Average Score
2024 0 0.00
2023 0 0.00
2022 0 0.00
2021 0 0.00
2020 3 8.80
2019 0 0.00
2018 1 9.80

It may take a day or so for new Netbeans vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Apache Netbeans Security Vulnerabilities

To be able to analyze gradle projects, the build scripts need to be executed

CVE-2020-11986 9.8 - Critical - September 09, 2020

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads

CVE-2019-17560 9.1 - Critical - March 30, 2020

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

Improper Certificate Validation

The "Apache NetBeans" autoupdate system does not fully validate code signatures

CVE-2019-17561 7.5 - High - March 30, 2020

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

Improper Verification of Cryptographic Signature

Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE)

CVE-2018-17191 9.8 - Critical - December 31, 2018

Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn script engine the environment of the javascript execution for the Proxy Auto-Configuration leaks privileged objects, that can be used to circumvent the execution limits. If a different script engine was used, no execution limits were in place. Both vectors allow remote code execution.

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Apache Netbeans or by Apache? Click the Watch button to subscribe.

Apache
Vendor

subscribe